Japan Accuses Chinese Hackers of Dozens of Cyberattacks

Japan on Monday accused Chinese hacker group MirrorFace of more than 200 cyberattacks carried out over the past five years against the country, targeting national security agencies and high-tech data.

Japan's National Police Agency (NPA) said its analysis of the targets, methods and infrastructure of MirrorFace's cyberattacks between 2019 and 2024 concluded that they were systematic attacks linked to China, aimed at stealing data on Japanese national security and advanced technology.

The targets of the Chinese government-led cyberattacks included Japan's foreign and defense ministries, the country's space agency and individuals including politicians, journalists, private companies and think tanks related to advanced technology, the NPA said.

Experts have repeatedly expressed concern about Japan’s cybersecurity vulnerability, especially as the country builds up its defense capabilities and works more closely with the United States and other partners to strengthen cyber defenses.

MirrorFace sent emails with virus-laden attachments to organizations and individuals seeking to view data stored on computers, primarily between December 2019 and July 2023, often using Gmail and Microsoft Outlook addresses of stolen identities, the NPA investigation found.

The emails typically used subject lines such as “Japan-U.S. alliance,” “Taiwan Strait,” “Russia-Ukraine war” and “free and open Indo-Pacific” and included an invitation to a study panel, references and a list of panelists, the NPA said.

In another tactic, hackers targeted Japanese organizations in the aerospace, semiconductor, and information and communications industries between February and October 2023, exploiting vulnerabilities in virtual private networks to gain unauthorized access to information.

Targets included the Japan Aerospace and Exploration Agency, or JAXA, which acknowledged in June that it had suffered a series of cyberattacks since 2023, although sensitive information related to rockets, satellites and defense was not affected.

Last year, a cyberattack paralyzed operations at a container terminal at a port in the city of Nagoya for three days.

More recently, Japan Airlines was hit by a cyberattack over Christmas, causing delays and cancellations to more than 20 domestic flights, although the carrier was able to stop the attack and restore its systems hours later.