LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0275: UPPERCUT

UPPERCUT is a 32-bit HTTP-based backdoor that has been used by menuPass since at least 2017.[1] Once thought to be exclusive to menuPass, UPPERCUT was also observed being used by menuPass-associated MirrorFace during Operation AkaiRyū.[2]

EnterpriseS0275MalwareObject v2.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

UPPERCUT matters because it represents a Windows HTTP-based backdoor associated in ATT&CK with long-running espionage activity and later campaign use. For leaders, the practical issue is not the malware name alone; it is whether the organization can recognize a compromised Windows host that is using ordinary-looking web traffic for command and control, running command shell activity, collecting local data, capturing screens, transferring tools, and performing discovery before responders have clear visibility.

Executive priority

Prioritize this as a validation case for Windows endpoint monitoring, web egress visibility, and incident response readiness. Because ATT&CK provides no official detection guidance for UPPERCUT, executives should ask whether SOC teams can prove coverage for the related behaviors: suspicious HTTP-based C2, command shell execution, discovery commands, file and screen collection, tool transfer, UAC bypass indicators, DLL abuse, encoded or encrypted traffic, and delayed execution. This supports resilience, audit evidence, and budget decisions around endpoint logging, network telemetry, and managed detection quality.

Technical view

Treat UPPERCUT as a Windows backdoor behavior cluster rather than a single signature. ATT&CK relationships link it to Windows Command Shell, Web Protocols, Data from Local System, System/User/Network/File/Time Discovery, Ingress Tool Transfer, Screen Capture, Standard Encoding, Symmetric Cryptography, Bypass User Account Control, DLL abuse, and Delay Execution. Detection engineering should validate correlation across process execution, parent-child process chains, DLL load behavior, privilege elevation events, host discovery commands, file access, screenshot-related activity, and outbound HTTP sessions that do not match normal user or application patterns.

Likely telemetry

  • Windows endpoint process creation and command-line logs
  • Parent-child process relationships involving command shell activity
  • Windows privilege elevation and UAC-related events
  • DLL load, side-loading, or unusual module path telemetry
  • File and directory enumeration and sensitive file access telemetry

Detection direction

  • Do not rely on a malware-name alert alone; ATT&CK does not provide official detection text for this object.
  • Build detections around behavior combinations: HTTP egress plus command shell execution plus discovery or collection activity on a Windows host.
  • Baseline approved administrative discovery and scripting activity to reduce false positives from IT operations.
  • Review whether web monitoring can distinguish normal browser/application traffic from unusual host-initiated HTTP command-and-control patterns.
  • Correlate UAC bypass indicators and DLL abuse with subsequent command execution, discovery, or external communication.

Mitigation priorities

  • Ensure Windows endpoint logging captures process creation, command lines, module loads, privilege elevation, and file activity needed for investigation.
  • Restrict and monitor unnecessary outbound web traffic from servers and high-value workstations using egress controls and proxy logging.
  • Apply least privilege and administrative control review to reduce the value of UAC bypass attempts.
  • Harden DLL search-order and application execution paths where feasible, and monitor unexpected DLL loading from user-writable locations.
  • Limit unauthorized tool transfer through controlled download paths, web filtering, and alerting on unusual external file retrieval.
Additional notes and limits

The object is a malware entry for UPPERCUT, described by ATT&CK as a 32-bit HTTP-based backdoor used by menuPass since at least 2017 and also observed with MirrorFace-associated Operation AkaiRyū. The most useful defensive value comes from the mapped behaviors, especially Windows command execution, discovery, collection, tool transfer, C2 over web protocols, encoding/encryption, UAC bypass, DLL abuse, and delayed execution.

ATT&CK does not provide official detection guidance, aliases, labels, or explicit tactics on the malware object itself. Relationship descriptions are partially truncated in the supplied data, and technique platform lists may be broader than this malware object’s Windows platform. Local environment telemetry, baselines, and approved administrative activity are required before making coverage or exposure claims.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

UPPERCUT

UPPERCUT is a 32-bit HTTP-based backdoor that has been used by menuPass since at least 2017.[1] Once thought to be exclusive to menuPass, UPPERCUT was also observed being used by menuPass-associated MirrorFace during Operation AkaiRyū.[2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

15 rows
DomainIDNameRelationship / procedure
EnterpriseT1071.001Web ProtocolsSub-technique

UPPERCUT has used HTTP for C2, including sending error codes in cookie headers.[1][2][3]

EnterpriseT1124System Time Discovery

UPPERCUT has the capability to obtain the time zone information and the current timestamp of the victim’s machine.[1]

EnterpriseT1033System Owner/User Discovery

UPPERCUT has the capability to collect the current logged on user’s username from a machine.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

UPPERCUT uses cmd.exe to execute commands on the victim’s machine.[1]

EnterpriseT1574.001DLLSub-technique

UPPERCUT has been sideloaded through a legitimately signed application from the JustSystems Corporation.[3]

EnterpriseT1113Screen Capture

UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.[1][4][2][3]

EnterpriseT1573.001Symmetric CryptographySub-technique

Some versions of UPPERCUT have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address.[1] UPPERCUT has also used custom ChaCha20, XOR, and LZO algorithms for C2 communication.[4][2]

EnterpriseT1016System Network Configuration Discovery

UPPERCUT has the capability to gather the victim's proxy information.[1]

EnterpriseT1132.001Standard EncodingSub-technique

UPPERCUT can base64 encode C2 communications.[2]

EnterpriseT1082System Information Discovery

UPPERCUT has the capability to gather the system’s hostname and OS version.[1][2]

EnterpriseT1105Ingress Tool Transfer

UPPERCUT can download and upload files to and from the victim’s machine.[1][4][2]

EnterpriseT1548.002Bypass User Account ControlSub-technique

UPPERCUT contains functionality to bypass UAC.[4][2]

EnterpriseT1005Data from Local System

UPPERCUT can upload files to the C2 from infected machines.[4][2]

EnterpriseT1678Delay Execution

UPPERCUT can use a sleep function to delay execution.[4][2]

EnterpriseT1083File and Directory Discovery

UPPERCUT has the capability to gather the victim's current directory.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0045: menuPass

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.[1][2]

menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.[3][4][5][6][7][1][2]

GroupEnterprise

G1054: MirrorFace

MirrorFace is a People's Republic of China (PRC)-aligned cyberespionage actor believed to be a subgroup under the menuPass umbrella based on targeting, tools, and infrastructure overlaps. MirrorFace has been active since at least 2019, at first exclusively targeting Japanese organizations across the media, defense, diplomatic, financial, manufacturing, and academic sectors. Subsequent MirrorFace operations included targets in Central Europe and featured use of LODEINFO, HiddenFace, and UPPERCUT malware.[1][2][3][4][5][6]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · GroupG0045: menuPassEnterpriseuses · GroupG1054: MirrorFaceEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · CampaignC0060: Operation AkaiRyūEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1678: Delay ExecutionEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
0f3a9eab109a75f5...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.0Current bundle0f3a9eab109a…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  2. [2]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  3. [3]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  4. [4]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  5. [5]
    ANEL

    (Citation: FireEye APT10 Sept 2018)

  6. [6]
    ANEL

    (Citation: FireEye APT10 Sept 2018)

  7. [7]
    ANEL

    (Citation: FireEye APT10 Sept 2018)

  8. [8]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  9. [9]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  10. [10]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  11. [11]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  12. [12]
    UPPERCUT

    (Citation: FireEye APT10 Sept 2018)

  13. [13]
    UPPERCUT

    (Citation: FireEye APT10 Sept 2018)

  14. [14]
    UPPERCUT

    (Citation: FireEye APT10 Sept 2018)

  15. [15]
    mitre-attackS0275
    Open source URL
  16. [16]
    mitre-attackS0275
    Open source URL
  17. [17]
    mitre-attackS0275
    Open source URL
  18. [18]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  19. [19]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  20. [20]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  21. [21]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  22. [22]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  23. [23]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  24. [24]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  25. [25]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  26. [26]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  27. [27]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  28. [28]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  29. [29]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  30. [30]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  31. [31]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  32. [32]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  33. [33]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  34. [34]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  35. [35]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  36. [36]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  37. [37]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  38. [38]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  39. [39]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  40. [40]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  41. [41]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  42. [42]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  43. [43]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  44. [44]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  45. [45]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  46. [46]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  47. [47]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  48. [48]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  49. [49]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  50. [50]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  51. [51]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  52. [52]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  53. [53]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  54. [54]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  55. [55]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  56. [56]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  57. [57]
    ESET MirrorFace 2025

    Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.

    Open source URL
  58. [58]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  59. [59]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  60. [60]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  61. [61]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
  62. [62]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  63. [63]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  64. [64]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  65. [65]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  66. [66]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  67. [67]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  68. [68]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  69. [69]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  70. [70]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  71. [71]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  72. [72]
    Trend Micro Earth Kasha Anel NOV 2024

    Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.

    Open source URL
  73. [73]
    Trend Micro Earth Kasha Updates APR 2025

    Hiroaki, H. (2025, April 30). Earth Kasha Updates TTPs in Latest Campaign Targeting Taiwan and Japan. Retrieved April 17, 2026.

    Open source URL
  74. [74]
    FireEye APT10 Sept 2018

    Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use