Cyber Incident Victim: 株式会社 丸山製作所
Date:
Feb 2022
Location:
Japan
Summary
A Maruyama Manufacturing employee's computer was infected by Emotet malware, resulting in the theft of email data including internal and external contact names, email addresses, and message subjects. Attackers subsequently sent fraudulent emails impersonating company personnel, containing malware-laden encrypted ZIP attachments that risked further infections or unauthorized access if opened. The compromised information led to widespread impersonation attempts targeting clients and partners, with the company confirming data exfiltration and urging recipients to verify sender domains matching its official "@maruyama.co.jp" addresses. The organization initiated an investigation to prevent secondary damage while committing to strengthened cybersecurity measures following the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 2 techniques |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On February 8, 2022, Maruyama Manufacturing Co. discovered that an employee's computer within their corporate group had been infected with the Emotet malware. This infection resulted in the theft of email-related information, including email addresses, names, and subject lines belonging to both internal and external stakeholders. The compromised data was subsequently used by third parties to send fraudulent emails impersonating Maruyama employees to multiple recipients. The company confirmed these suspicious emails contained encrypted ZIP file attachments harboring malware, posing risks of further infections or unauthorized access if opened. Analysis revealed a key identifier of the fraudulent messages: discrepancies between the sender's displayed name and actual email address, with legitimate Maruyama communications exclusively using the "@maruyama.co.jp" domain.
Maruyama Manufacturing publicly acknowledged the incident on February 9, 2022, apologizing for the concern and inconvenience caused to customers, business partners, and affected individuals. They advised recipients to verify sender addresses, delete suspicious emails entirely if the domain differed from their official one, and avoid interacting with attachments or embedded links. The company initiated investigations to determine the full scope of the breach and prevent secondary damage or wider dissemination of malicious emails. While no specific remediation measures were detailed, Maruyama committed to strengthening information security protocols to prevent recurrence. They directed inquiries to their IT Planning Department and referenced the Japanese Information Processing Promotion Agency (IPA) for technical details about Emotet’s functionality, confirming reliance on external cybersecurity expertise for supplementary guidance.