Loading threat actor…
Blue Termite, also known as Cloudy Omega, is an advanced persistent threat group associated with long-running cyber-espionage operations primarily targeting organizations in Japan since at least 2013. The actor has been linked to campaigns against Japanese government agencies, local governments, universities, financial institutions, energy companies, communications providers, heavy industry, chemicals, automotive, electrical manufacturing, media, information services, health care, real estate, food, semiconductors, robotics, construction, insurance, transportation, and the Japan Pension Service. Blue Termite is known for exploiting vulnerabilities in software widely used in Japan, including Ichitaro and Sanshiro, and for using Adobe Flash exploitation in drive-by-download and watering hole operations. Reported initial access methods include spear-phishing with malicious documents, watering hole compromises, and drive-by exploitation. Campaigns attributed to the group have delivered malware including Emdivi and PlugX, with Emdivi serving as a core implant family. Emdivi variants have functioned both as initial backdoors and as more tailored post-compromise implants with expanded command sets and encrypted configuration storage. The group has demonstrated significant victim-specific customization. Observed Emdivi samples used encrypted configuration data, hardcoded internal proxy settings, and decryption schemes tied to host-specific identifiers, indicating malware builds tailored to intended targets. Later variants added stronger protections to hinder analysis. Blue Termite activity has also been associated with command-and-control servers hosting web backdoors, suggesting use of compromised infrastructure to support operations. Operationally, Blue Termite has shown capabilities spanning initial access, persistence, reconnaissance, post-exploitation, and exfiltration through remote access tooling. The actor’s tradecraft and victimology are consistent with a focused espionage mission against Japanese public- and private-sector entities. Reporting has also noted evidence pointing to China as the likely origin of the group.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
24 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
5 CVEs this actor has used in observed campaigns. 5 of them exploited in the wild.
In 2013, a compromised website was found embedded with a Java Applet which leverages a Java vulnerability (CVE-2011-3544), resulting in Emdivi being downloaded to visitors’ devices.
Vulnerabilities in the kernel-mode driver (CVE-2014-4113) and Kerberos KDC (CVE-2014-6324) were leveraged for privilege escalation.
Vulnerabilities in the kernel-mode driver (CVE-2014-4113) and Kerberos KDC (CVE-2014-6324) were leveraged for privilege escalation.
CVE-2014-7247 was exploited as a zero-day vulnerability. The attack was carried out through targeted emails which were distributed to government agencies and enterprises in Japan.
Kaspersky Lab has detected a new method of first infection that uses a drive-by-download with a flash exploit (CVE-2015-5119, the one leaked from The Hacking Team incident). Several Japanese web sites have been compromised with this method.
68 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cyber-espionage campaign primarily targeting Japanese organizations using spear-phishing, watering hole, and drive-by-download attacks with a Flash exploit, followed by deployment of the Emdivi malware family.
Cyber-espionage campaigns targeting Japanese government agencies and enterprises using spear-phishing, watering-hole attacks, and Ichitaro zero-days to deploy Emdivi and PlugX, followed by credential theft, privilege escalation, persistence, and internal spread.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.