text: One of the decoy documents, for instance, was about the “plan of disaster prevention in heisei 20” (Heisei is the current/modern era in Japan).  Figure 1: File properties of one of the decoy documents that REDBALDKNIGHT sends to Japanese targets  Figures 2: Sample of decoy documents used by REDBALDKNIGHT, employing socially engineered titles in their spear phishing emails such as “disaster prevention”