Threat actors from the Earth Yako APT group have been conducting a year-long targeting campaign against Japanese think tanks, researchers, and academic institutions. Earth Yako is a lesser-known threat group that has made a significant impact during this operation, showing their motivation lies with cyberespionage against their victims. The operation, dubbed Operation RestyLink/Enelink, began in January 2022 and has continuously targeted entities throughout the education sector with a variety of malicious tools and software. The standard point-of-entry for Operation RestyLink is spearphishing, attempting to persuade the user to download an embedded attachment which would eventually lead to the background download of one (1) or more malicious programs such as “MirrorKey” (DLL Loader), “TransBox” (Trojan), “PlugBox” (Trojan), “Dulload” (Generic), “PULink” (Dropper), and “ShellBox” (Stager). Incidents analyzed in this campaign include a Japanese academic center becoming compromised in March 2022 where MirrorKey and TransBox malware payloads were deployed. Months later in June, Earth Yako actors compromised researchers at another Japanese academic center and utilized MirrorKey and PlugBox payloads to further infect the compromised asset(s). Several additional incidents have occurred throughout this campaign, oftentimes for espionage purposes. CTIX analysts continue to monitor threat actor activity worldwide and will provide additional updates accordingly.