Campaign · all campaigns

Operation AkaiRyūC0060 unknown

aka Operation AkaiRyū, AkaiRyū

Last updated: 2026-07-03

0attributed CVEs

40ATT&CK techniques

0.0IDF score (tooling uniqueness)

0exclusive CVEs

—years active

About this actor

[Operation AkaiRyū](https://attack.mitre.org/campaigns/C0060) (Japanese for RedDragon) was a cyberespionage spearphishing campaign conducted by [MirrorFace](https://attack.mitre.org/groups/G1054) between June and September 2024 against entities in Japan and Central Europe. [Operation AkaiRyū](https://attack.mitre.org/campaigns/C0060) notably included the first reported targeting of a European entity by [MirrorFace](https://attack.mitre.org/groups/G1054), as well as their use of [UPPERCUT](https://attack.mitre.org/software/S0275), which was thought to be exclusive to [menuPass](https://attack.mitre.org/groups/G0045).(Citation: ESET MirrorFace 2025)(Citation: Trend Micro Earth Kasha Anel NOV 2024)

Source: MITRE ATT&CK

Activity timeline

No activity events recorded.

Profile

CVE	Risk	CVSS	EPSS	Published	Products
No attributed CVEs.

Mitigating controls (NIST 800-53)

Control	Techniques covered	Coverage
`SI-4`	22 / 40	55%
`CM-2`	21 / 40	52%
`CM-6`	21 / 40	52%
`SI-3`	19 / 40	48%
`SI-7`	14 / 40	35%
`CA-7`	13 / 40	32%
`AC-6`	12 / 40	30%
`CM-7`	12 / 40	30%
`AC-3`	11 / 40	28%
`SI-10`	11 / 40	28%
`AC-2`	10 / 40	25%
`RA-5`	10 / 40	25%
`SI-2`	10 / 40	25%
`AC-17`	9 / 40	22%
`CM-8`	8 / 40	20%

Co-occurring actors

None.