Skip to content
brandefense.io
Request A Demo
Nation-state APTEspionage

Earth Yako

Earth Yako is a nation-state APT group with an espionage motive, tracked by Brandefense. It targets organisations in Japan.

Also known as
  • Operation RestyLink
  • Enelink
  • Operation Enelink
Request IOC feedRequest ATT&CK export
Techniques
0
Exploited CVEs
No CVE data
First seen
Jan 1, 2021
Record updated

Who They Target.

Countries · 1

About Earth Yako.

Earth Yako is a threat actor that has been actively targeting researchers in academic organizations and think tanks in Japan. They use spearphishing emails with malicious attachments to gain initial access to their targets' systems. Earth Yako's objectives and patterns suggest a possible connection to a Chinese APT group, but conclusive proof of their nationality is lacking. They have been observed using various malware delivery methods and techniques, such as the use of Winword.exe for DLL Hijacking.

Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.