Trend Micro's 2022 Japan targeted attack analysis observed four state-sponsored targeted-attack clusters in 2021, including Earth Kumiho/Kimsuky activity relevant to defense and diplomacy. The Earth Kumiho/Kimsuky section says the group was believed to have targeted defense and foreign-affairs personnel and left traces suggesting a watering-hole attack aimed at Japanese domestic users. The source notes that domestic continuous attacks by Earth Kumiho/Kimsuky had not been confirmed as of April 2022, so the attribution and targeting are presented as assessed from available traces and overseas cases. The broader report warns that targeted actors increasingly used VPN, network-device, and public-server vulnerabilities rather than only spearphishing, making logs and zero-trust controls important for incident investigation. It also references Lazarus Group, including Bluenoroff, in the historical chart of attack groups observed in Japan from 2018 to 2021.