Threat actormediumExploited in the wild

MILE TEA: Cyber Espionage Campaign Targets Asia Pacific Businesses and Government Agencies

Palo Alto Unit 42by Kaoru HayashiAug 17, 2026 · 12:56 UTC (Aug 17, 2026)9 min read4 · 1 read

AI summary · glm-5.3-flashSummaries by Vani AI

Unit 42 names MILE TEA, a cyber-espionage campaign since 2011 targeting Japanese and Taiwanese businesses and government agencies with e-ticket phishing lures and Elirks-family malware.

Unit 42 tracks the MILE TEA espionage campaign, observed as early as 2011, targeting Japanese trading, petroleum, and mobile companies, a Beijing office of a Japanese public organization, and a Taiwanese government agency. The primary infection vector is spear-phishing emails with attachments, mostly custom executable installers posing as flight e-tickets, dropping Elirks, Micrass, or Logedrut as initial bridgehead malware. Elirks and Logedrut retrieve encrypted C2 addresses from attacker-posted blog articles, decoded with Base64 and TEA or DES ciphers. The campaign's focus shifted from Taiwan to Japan around 2013.

Key facts

Campaign active since 2011, shifting primary targeting from Taiwan to Japan in 2013.
Custom installer drops Elirks, Micrass, or Logedrut as initial bridgehead malware.
Malware retrieves encrypted C2 addresses from articles posted on free blog services.
Flight e-ticket attachments are the most prevalent lure across the campaign.

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

ATT&CK: T1566.001 Spearphishing Attachment T1102.001 Dead Drop Resolver T1132.001 Standard Encoding

Tags: elirks espionage japan logedrut micrass mile-tea spear-phishing taiwan

Vendors: Palo Alto Networks
Threat actors: MILE TEA
Malware: Elirks Micrass Logedrut
Organizations: Palo Alto Networks
Countries: Japan Taiwan

Indicators of compromise

auto-extracted · verify before use · export allAll

From the original article

9 min read at unit42.paloaltonetworks.com

In June 2016, Unit 42 published the blog post “ Tracking Elirks Variants in Japan: Similarities to Previous Attacks ”, in which we described the resemblance of attacks using the Elirks malware family in Japan and Taiwan. Since then, we continued tracking this threat using Palo Alto Networks AutoFocus and discovered more details of the attacks, including target information.

Palo Alto Unit 42

By Kaoru Hayashi · unit42.paloaltonetworks.com

Read the full article at Palo Alto Unit 42

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.

Type	Indicator	Context
sha256	027ff8faf7952d791e39c9dda392dfce1094a4ceece46dbd2f53cf2ad5f8bc21	c61f95b8840c1d8a47e84c0704de8062e51c5fa3cf550612a879 Elirks 027ff8faf7952d791e39c9dda392dfce1094a4ceece46dbd2f53cf2ad5f8bc21 0cae035a40fcfc760a2f47b98ab27feaba9cee95d59467ab09b32063ac1
sha256	064474ac22dd28bf2211ca6602946409925b11f1cfa5e593487bf65e033f1057	mpromised organization. Windows Executable Custom Installer 064474ac22dd28bf2211ca6602946409925b11f1cfa5e593487bf65e033f1057 136978934c8a61e4adff415d4f8f6cd39d110cfa27df2c18367c7036c36
sha256	0cae035a40fcfc760a2f47b98ab27feaba9cee95d59467ab09b32063ac17df5b	8faf7952d791e39c9dda392dfce1094a4ceece46dbd2f53cf2ad5f8bc21 0cae035a40fcfc760a2f47b98ab27feaba9cee95d59467ab09b32063ac17df5b 0cffc3fb0b4ebf2a4b8cad4fb2a477737e4f8ca0b45494e541b2f92ee97
sha256	0cffc3fb0b4ebf2a4b8cad4fb2a477737e4f8ca0b45494e541b2f92ee9719fa8	35a40fcfc760a2f47b98ab27feaba9cee95d59467ab09b32063ac17df5b 0cffc3fb0b4ebf2a4b8cad4fb2a477737e4f8ca0b45494e541b2f92ee9719fa8 0e317e0fee4eb6c6e81b2a41029a9573d34cebeabab6d661709115c6452
sha256	0e317e0fee4eb6c6e81b2a41029a9573d34cebeabab6d661709115c64526bf95	3fb0b4ebf2a4b8cad4fb2a477737e4f8ca0b45494e541b2f92ee9719fa8 0e317e0fee4eb6c6e81b2a41029a9573d34cebeabab6d661709115c64526bf95 0f1f6838c591a0456881fbcd65d511932d2fa6c16fcb27eb4a793240ef0
sha256	0f1f6838c591a0456881fbcd65d511932d2fa6c16fcb27eb4a793240ef0c25de	e0fee4eb6c6e81b2a41029a9573d34cebeabab6d661709115c64526bf95 0f1f6838c591a0456881fbcd65d511932d2fa6c16fcb27eb4a793240ef0c25de 1194650bdfeb03940e07718726cfeb49645b089899e216a79cbafe7fae0
sha256	1194650bdfeb03940e07718726cfeb49645b089899e216a79cbafe7fae01678a	838c591a0456881fbcd65d511932d2fa6c16fcb27eb4a793240ef0c25de 1194650bdfeb03940e07718726cfeb49645b089899e216a79cbafe7fae01678a 138993de871eefc72967b61b7c030649e1881be8adacbee933636fb4fc2
sha256	136978934c8a61e4adff415d4f8f6cd39d110cfa27df2c18367c7036c36e006a	4ac22dd28bf2211ca6602946409925b11f1cfa5e593487bf65e033f1057 136978934c8a61e4adff415d4f8f6cd39d110cfa27df2c18367c7036c36e006a 1ed808c7909bde7164d81a8c752a62ced116e03cfb6c7502019d84340f0
sha256	138993de871eefc72967b61b7c030649e1881be8adacbee933636fb4fc2ae444	50bdfeb03940e07718726cfeb49645b089899e216a79cbafe7fae01678a 138993de871eefc72967b61b7c030649e1881be8adacbee933636fb4fc2ae444 1434fa8719602b252bb12e1e0023e86becada3b86ed07e1f7836fdf057d
sha256	1434fa8719602b252bb12e1e0023e86becada3b86ed07e1f7836fdf057dcebf5	3de871eefc72967b61b7c030649e1881be8adacbee933636fb4fc2ae444 1434fa8719602b252bb12e1e0023e86becada3b86ed07e1f7836fdf057dcebf5 1fb47c308bfed89069a4dca561cf818910c25bf2e6bf2679992f01e2da3
sha256	1ed808c7909bde7164d81a8c752a62ced116e03cfb6c7502019d84340f04b76a	3bdf82c215312e30bf5ab07aafd0da0e6967897752e0c1d Taiwan 2013 1ed808c7909bde7164d81a8c752a62ced116e03cfb6c7502019d84340f04b76a Taiwan 2012 b6034a3fc6e01729166a4870593e66d9daf0cdff8726c42
sha256	1fb47c308bfed89069a4dca561cf818910c25bf2e6bf2679992f01e2da393506	a8719602b252bb12e1e0023e86becada3b86ed07e1f7836fdf057dcebf5 1fb47c308bfed89069a4dca561cf818910c25bf2e6bf2679992f01e2da393506 24ae29defeb167cba2dc8b647514e9c44c027c6f2ad6c789ec836358c10
sha256	200a4708afe812989451f5947aed2f30b8e9b8e609a91533984ffa55d02e60a2	963c0a37f12a167efd5ba702c142cd9f5571090f8838be4335 PDF File 200a4708afe812989451f5947aed2f30b8e9b8e609a91533984ffa55d02e60a2 5806703c28991675aee2e1204f748ce7e2814ea8f2a7ef925693fb52b0e
sha256	24ae29defeb167cba2dc8b647514e9c44c027c6f2ad6c789ec836358c1007f74	c308bfed89069a4dca561cf818910c25bf2e6bf2679992f01e2da393506 24ae29defeb167cba2dc8b647514e9c44c027c6f2ad6c789ec836358c1007f74 262d7106f1a227f278bcb344bc20186ff4231e1513aa61bd25c1da833cc
sha256	262d7106f1a227f278bcb344bc20186ff4231e1513aa61bd25c1da833cc142c5	9defeb167cba2dc8b647514e9c44c027c6f2ad6c789ec836358c1007f74 262d7106f1a227f278bcb344bc20186ff4231e1513aa61bd25c1da833cc142c5 27a836f9db61b63a7d90b9c13ec5e7dfdada65eae2860e748ba5dd4ca69
sha256	27a836f9db61b63a7d90b9c13ec5e7dfdada65eae2860e748ba5dd4ca6918b9b	106f1a227f278bcb344bc20186ff4231e1513aa61bd25c1da833cc142c5 27a836f9db61b63a7d90b9c13ec5e7dfdada65eae2860e748ba5dd4ca6918b9b 2dd6ff42d53b01c6f1c4ee3336c3ada53739de587adc78fb011237f9263
sha256	2d9c0f32401404ab515690e052d378b0acdd22e30ce8a6a2ce6e5088b2c62795	8e41bcf764493e203089e21bd35521da1c3c999e90eccb99a8 Logedrut 2d9c0f32401404ab515690e052d378b0acdd22e30ce8a6a2ce6e5088b2c62795 4591134a77b3532c85576e7b1942476eb73775d118e49ad215dbbe1c427
sha256	2dd6ff42d53b01c6f1c4ee3336c3ada53739de587adc78fb011237f926326f61	6f9db61b63a7d90b9c13ec5e7dfdada65eae2860e748ba5dd4ca6918b9b 2dd6ff42d53b01c6f1c4ee3336c3ada53739de587adc78fb011237f926326f61 38ae57f7e565dc51544c7b7c9b890eddeb3da7632a623e16cba5bdfd614
sha256	37e79e1ee7cde57cf3af80c54851fa3f9bea3a7208c5cdb5bd290d832f1c50c6	8c7909bde7164d81a8c752a62ced116e03cfb6c7502019d84340f04b76a 37e79e1ee7cde57cf3af80c54851fa3f9bea3a7208c5cdb5bd290d832f1c50c6 4607aa975fd9b5aaebe684b26fa31d8ef0840682b148dbcf7f57e9c35d1
sha256	38ae57f7e565dc51544c7b7c9b890eddeb3da7632a623e16cba5bdfd6141e241	f42d53b01c6f1c4ee3336c3ada53739de587adc78fb011237f926326f61 38ae57f7e565dc51544c7b7c9b890eddeb3da7632a623e16cba5bdfd6141e241 3acc6fec0e7275b3774af1274872d42c0afc330cf48d543ff8fdf4bb4b3
sha256	3acc6fec0e7275b3774af1274872d42c0afc330cf48d543ff8fdf4bb4b37ed73	7f7e565dc51544c7b7c9b890eddeb3da7632a623e16cba5bdfd6141e241 3acc6fec0e7275b3774af1274872d42c0afc330cf48d543ff8fdf4bb4b37ed73 40cc76ef34c03a04ad393b68c2110b0e58ec0a7b9da16fd5005993bd870
sha256	40cc76ef34c03a04ad393b68c2110b0e58ec0a7b9da16fd5005993bd8700b951	fec0e7275b3774af1274872d42c0afc330cf48d543ff8fdf4bb4b37ed73 40cc76ef34c03a04ad393b68c2110b0e58ec0a7b9da16fd5005993bd8700b951 45496be07ab8a3fad86980219073a28576106c8bca5c8fd70c882eef0e9
sha256	45496be07ab8a3fad86980219073a28576106c8bca5c8fd70c882eef0e9df428	6ef34c03a04ad393b68c2110b0e58ec0a7b9da16fd5005993bd8700b951 45496be07ab8a3fad86980219073a28576106c8bca5c8fd70c882eef0e9df428 53a3c1aa683d296c88bd6565a8b417f09e392ceae4c285464859df1953e
sha256	4591134a77b3532c85576e7b1942476eb73775d118e49ad215dbbe1c42761760	f32401404ab515690e052d378b0acdd22e30ce8a6a2ce6e5088b2c62795 4591134a77b3532c85576e7b1942476eb73775d118e49ad215dbbe1c42761760 66c9e75398c202c5c2b917fd0fe9a3089c6a1fa5e74a64c6a2c2b5d6aca
sha256	4607aa975fd9b5aaebe684b26fa31d8ef0840682b148dbcf7f57e9c35d107eb6	35bffd43ace22f9e9d695545de02d8b1d29c8ae38db3488 Taiwan 2014 4607aa975fd9b5aaebe684b26fa31d8ef0840682b148dbcf7f57e9c35d107eb6 Taiwan 2013 f23ab2ee9726c4061b2e0e7f6b9491e384de8103e410871
sha256	47c489ad097ea2813a993f05d0422361196efa8a7fec08c3f0c0d1d19db9f6a9	a975fd9b5aaebe684b26fa31d8ef0840682b148dbcf7f57e9c35d107eb6 47c489ad097ea2813a993f05d0422361196efa8a7fec08c3f0c0d1d19db9f6a9 5135377eb6db61ace45e88eca753fb08ae4e185176940e786050c0514a7
sha256	4bcc727506706634b56cad358828037189898097c363e2ea2147ec253b81a009	a3cfe6b0ea3bcbc7893eb1da84e612060ecfffb8110fa0199a2 Micrass 4bcc727506706634b56cad358828037189898097c363e2ea2147ec253b81a009 674865c337f23ab23b7c866893d179467e5f834ee95a0952aaeb7fa7f3d
sha256	5135377eb6db61ace45e88eca753fb08ae4e185176940e786050c0514a775294	9ad097ea2813a993f05d0422361196efa8a7fec08c3f0c0d1d19db9f6a9 5135377eb6db61ace45e88eca753fb08ae4e185176940e786050c0514a775294 5de5346613be67e3e3bdf82c215312e30bf5ab07aafd0da0e6967897752
sha256	53a3c1aa683d296c88bd6565a8b417f09e392ceae4c285464859df1953e75382	be07ab8a3fad86980219073a28576106c8bca5c8fd70c882eef0e9df428 53a3c1aa683d296c88bd6565a8b417f09e392ceae4c285464859df1953e75382 569ee23acc18b5ff0f18f02d5010d0e9e9870a9b5845c3618e6f31ee455
sha256	569ee23acc18b5ff0f18f02d5010d0e9e9870a9b5845c3618e6f31ee4552c475	1aa683d296c88bd6565a8b417f09e392ceae4c285464859df1953e75382 569ee23acc18b5ff0f18f02d5010d0e9e9870a9b5845c3618e6f31ee4552c475 58f2790133e5987f6f3eb960c5ad547e149a037b1f5a56526026d8a22f7
sha256	5806703c28991675aee2e1204f748ce7e2814ea8f2a7ef925693fb52b0ef4d9c	708afe812989451f5947aed2f30b8e9b8e609a91533984ffa55d02e60a2 5806703c28991675aee2e1204f748ce7e2814ea8f2a7ef925693fb52b0ef4d9c 755138308bbaa9fcb9c60f0b089032ed4fa1cece830a954ad574bd0c2fe
sha256	58f2790133e5987f6f3eb960c5ad547e149a037b1f5a56526026d8a22f7fa51e	23acc18b5ff0f18f02d5010d0e9e9870a9b5845c3618e6f31ee4552c475 58f2790133e5987f6f3eb960c5ad547e149a037b1f5a56526026d8a22f7fa51e 5b01d16a4d39cc30a6dd501d214c8ee4916e46ab338c3437f4cf1ae6f71
sha256	5b01d16a4d39cc30a6dd501d214c8ee4916e46ab338c3437f4cf1ae6f71d1ae6	90133e5987f6f3eb960c5ad547e149a037b1f5a56526026d8a22f7fa51e 5b01d16a4d39cc30a6dd501d214c8ee4916e46ab338c3437f4cf1ae6f71d1ae6 5d4b91593d1cc110c966a3b3bcca6c02492e6df5dff83cd0653f9ffca9d
sha256	5d4b91593d1cc110c966a3b3bcca6c02492e6df5dff83cd0653f9ffca9d5256e	16a4d39cc30a6dd501d214c8ee4916e46ab338c3437f4cf1ae6f71d1ae6 5d4b91593d1cc110c966a3b3bcca6c02492e6df5dff83cd0653f9ffca9d5256e 5e4377e4d0998c09db357d8cd393c949af66a3cd7592a427752dc876430
sha256	5de5346613be67e3e3bdf82c215312e30bf5ab07aafd0da0e6967897752e0c1d	b2e0e7f6b9491e384de8103e410871c34b603326b7672da Taiwan 2013 5de5346613be67e3e3bdf82c215312e30bf5ab07aafd0da0e6967897752e0c1d Taiwan 2013 1ed808c7909bde7164d81a8c752a62ced116e03cfb6c750
sha256	5e4377e4d0998c09db357d8cd393c949af66a3cd7592a427752dc876430dbef2	1593d1cc110c966a3b3bcca6c02492e6df5dff83cd0653f9ffca9d5256e 5e4377e4d0998c09db357d8cd393c949af66a3cd7592a427752dc876430dbef2 633e849407f22fae3e5c6d2bf1921f1b11074229c797ea1e57a85cbc058
sha256	633e849407f22fae3e5c6d2bf1921f1b11074229c797ea1e57a85cbc05880c84	7e4d0998c09db357d8cd393c949af66a3cd7592a427752dc876430dbef2 633e849407f22fae3e5c6d2bf1921f1b11074229c797ea1e57a85cbc05880c84 636c3af6ca45f5ebc413fdde9e706603151e4ce081bc73addf666ba6c9d
sha256	636c3af6ca45f5ebc413fdde9e706603151e4ce081bc73addf666ba6c9d198ba	49407f22fae3e5c6d2bf1921f1b11074229c797ea1e57a85cbc05880c84 636c3af6ca45f5ebc413fdde9e706603151e4ce081bc73addf666ba6c9d198ba 688e33d45ae76dbbbd0f7462f4736453c36abfbf3d6fd1cca02a8e7ef0e
sha256	66c9e75398c202c5c2b917fd0fe9a3089c6a1fa5e74a64c6a2c2b5d6acaf2f14	34a77b3532c85576e7b1942476eb73775d118e49ad215dbbe1c42761760 66c9e75398c202c5c2b917fd0fe9a3089c6a1fa5e74a64c6a2c2b5d6acaf2f14 843b14a44374987ebdd735d23ac89f8aef8c6972510d53d283eb79004c5
sha256	674865c337f23ab23b7c866893d179467e5f834ee95a0952aaeb7fa7f3d34573	27506706634b56cad358828037189898097c363e2ea2147ec253b81a009 674865c337f23ab23b7c866893d179467e5f834ee95a0952aaeb7fa7f3d34573 68ec202ebce…