MILE TEA: Cyber Espionage Campaign Targets Asia Pacific Businesses and Government Agencies
Summary: Unit 42 documented a campaign it named MILE TEA, active since as early as 2011, that uses spear-phishing emails with malicious attachments - often purported flight e-tickets - to deliver a custom installer that drops the Micrass, Logedrut and Elirks malware families. Identified targets include three Japanese trading companies, a Japanese petroleum company, a Japanese mobile phone organization, the Beijing office of a Japanese public organization, and a government agency in Taiwan, with the target base shifting from Taiwan to Japan in mid-2013.
What's compelling: Since early 2015 the actor has used documents stolen from previously compromised organizations as decoys, in one case reusing a Japanese trading company's weekly report within a week of its theft - so a convincing attachment may be your own industry's real paperwork.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026