Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Campaigns/C0060
MITRE ATT&CK Campaign · 2024–2024

Operation AkaiRyū (C0060)

ShareXLinkedInRedditHN

[Operation AkaiRyū](https://attack.mitre.org/campaigns/C0060) (Japanese for RedDragon) was a cyberespionage spearphishing campaign conducted by [MirrorFace](https://attack.mitre.org/groups/G1054) between June and September 2024 against entities in Japan and Central Europe. [Operation AkaiRyū](https://attack.mitre.org/campaigns/C0060) notably included the first reported targeting of a European entity by [MirrorFace](https://attack.mitre.org/groups/G1054), as well as their use of [UPPERCUT](https://attack.mitre.org/software/S0275), which was thought to be exclusive to [menuPass](https://attack.mitre.org/groups/G0045).(Citation: ESET MirrorFace 2025)(Citation: Trend Micro Earth Kasha Anel NOV 2024)

▪Attributed groups (1)

G1054MirrorFace

▪Techniques used (26)

T1204.001Malicious LinkT1059.005Visual BasicT1588.002Tool

▪Software used (8)

S9026ROAMINGHOUSEmalwareS9023HiddenFacemalware
C0060 on MITRE ATT&CK →
T1082System Information Discovery
T1585.003Cloud Accounts
T1204.002Malicious File
T1587.001Malware
T1127.001MSBuild
T1685.005Clear Windows Event Logs
T1553.002Code Signing
T1059.003Windows Command Shell
T1016System Network Configuration Discovery
T1070.004File Deletion
T1219.001IDE Tunneling
T1083File and Directory Discovery
T1608.005Link Target
T1566.001Spearphishing Attachment
T1217Browser Information Discovery
T1219Remote Access Tools
T1566.002Spearphishing Link
T1586.002Email Accounts
T1047Windows Management Instrumentation
T1137.001Office Template Macros
T1036.008Masquerade File Type
T1059.001PowerShell
T1585.002Email Accounts
S9027ANELLDRmalware
S1087AsyncRATtool
S0099Arptool
S0275UPPERCUTmalware
S1071Rubeustool
S1144FRPtool

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.