Executive Summary
Ransomware incidents in Japan increased by approximately 4.7% in the first half of 2026 compared to the same period in 2025, with 90 confirmed incidents affecting Japanese organizations between January and July 2026 (Cisco Talos Intelligence, 2026-09-17). The majority of victims were small- and medium-sized enterprises (SMEs), with 78% having capital below JPY 1 billion and 48% below JPY 100 million. The manufacturing sector was the most targeted, accounting for 34% of incidents, followed by the information and communications sector (11%) and services (9%). The Gentlemen ransomware group emerged as the most active threat actor, responsible for 14 incidents, while Qilin and SafePay each accounted for seven. The Gentlemen’s infrastructure leverages a range of advanced tools and exploits, including double-extortion tactics and the use of open-source frameworks for lateral movement and data exfiltration. Qilin was observed using AI-generated Python scripts to automate destructive and disruptive actions, such as deploying wipers and disabling backup systems, with technical evidence indicating the use of large language models (LLMs) in tool development. These developments highlight a shift toward more rapid and scalable ransomware operations, with a growing emphasis on behavioral detection over traditional signature-based defenses. All findings are based on direct technical evidence and sector-specific analysis from Cisco Talos Intelligence, Cloud Security Alliance, and Check Point Research.
Technical Information
Ransomware activity in Japan during the first half of 2026 demonstrated both an increase in incident volume and a significant evolution in attacker tactics and tooling. The Gentlemen, a ransomware-as-a-service (RaaS) group first observed in July 2025, became the most active ransomware operator in Japan, with 14 confirmed incidents and over 328 claimed victims globally in Q2 2026 (Cloud Security Alliance, 2026-09-18; Check Point Research, 2026). Qilin, rebranded from Agenda in 2022, was the second most active group, with seven incidents in Japan and over 1,400 global victims between mid-2025 and mid-2026.
The Gentlemen’s Infrastructure
The Gentlemen operates as a RaaS platform, enabling affiliates to conduct attacks using a standardized toolkit. The group employs a double-extortion model, encrypting victim data and threatening public release unless a ransom is paid. Technical analysis revealed the use of the following tools and techniques:
- Initial Access: Exploitation of VPNs and use of tunneling tools such as Chisel and Ligolo-ng to establish footholds within target networks (Cisco Talos Intelligence, 2026-09-17).
- Reconnaissance: Network scanning with nmap and masscan to map internal assets.
- Credential Access and Lateral Movement: Use of BloodHound and NetExec for Active Directory (AD) reconnaissance, Responder for adversary-in-the-middle (AitM) attacks, and impacket-partial-mic for NTLM relay attacks.
- Exploitation: Targeting of CVE-2025-24799, a SQL injection vulnerability in GLPI, to escalate privileges and move laterally.
- Persistence and Privilege Escalation: Deployment of AnyDesk for remote desktop access.
- Data Exfiltration: Use of Rclone to transfer stolen data to Wasabi cloud storage.
- Command and Control (C2): Operation of AdaptixC2, Chisel, and Ligolo-ng for ongoing access and control.
- Impact: Encryption of data and deletion of traces to inhibit recovery.
Attribution to Russian-speaking operators is supported by the presence of Russian-language comments and keyboard layouts in recovered scripts and shell history files. This evidence is assessed as high confidence due to its direct technical nature.
Qilin’s AI Use
Qilin was observed leveraging AI-generated Python scripts to automate key stages of the attack lifecycle. During incident response, researchers discovered an open directory containing scripts named deadman.py, veeam_kill.py, and deploy_locker.py. These scripts exhibited characteristics consistent with large language model (LLM) generation, including:
- Structured, documentation-style comments.
- Redundant, step-by-step logging.
- References to an “llm_chatbot” directory in bash history.
deadman.py was designed to deploy a wiper payload via AD Group Policy Objects (GPOs), veeam_kill.py disabled Veeam backup agents, and deploy_locker.py handled ransomware deployment with extensive inline documentation. The use of AI coding assistants enables rapid regeneration of functionally equivalent scripts, reducing the effectiveness of signature-based detection. Behavioral detection—such as monitoring for unauthorized GPO changes, abrupt backup agent terminations, and anomalous AD enumeration—is recommended.
Sector and Victim Profile
The manufacturing sector accounted for 34% of incidents, reflecting both the prevalence of legacy systems and the sector’s critical role in supply chains. Information and communications (11%) and services (9%) were also heavily targeted. SMEs with capital below JPY 1 billion comprised 78% of victims, with 48% below JPY 100 million. This concentration suggests either deliberate targeting of under-resourced firms or opportunistic exploitation of the most numerous and vulnerable organizations. Approximately 13.3% of incidents involved overseas offices or subsidiaries, with Taiwan, the United States, and the Philippines most frequently affected.
Technical Artifacts and Attribution
High-confidence technical artifacts associated with The Gentlemen include the use of RustHound, BloodHound, NetExec, Responder, impacket-partial-mic, Ligolo-ng, Chisel, AnyDesk, Rclone, AdaptixC2, nmap, masscan, and exploitation of CVE-2025-24799. For Qilin, the presence of AI-generated scripts and command history referencing “llm_chatbot” provide medium-to-high confidence of LLM involvement. Attribution to Russian-speaking operators in The Gentlemen is based on language and keyboard evidence, while Qilin’s AI use is inferred from code structure and development artifacts.
Affected Versions & Timeline
The ransomware incidents analyzed occurred between January and July 2026. The Gentlemen’s activity increased sharply during this period, with the number of victim listings on its leak site rising from 48 in January to 105 in July (Cisco Talos Intelligence, 2026-09-17). Qilin’s AI-generated tooling was first observed in open directories during incident response investigations in the same timeframe. The exploitation of CVE-2025-24799 (GLPI SQL injection) was a key vector for The Gentlemen, affecting unpatched versions of GLPI prior to the release of security updates in late 2025.
Threat Activity
The threat landscape in Japan during H1 2026 was characterized by a shift toward newer ransomware groups and the adoption of advanced tooling. The Gentlemen’s rapid rise is attributed to its RaaS model, technical sophistication, and aggressive targeting of SMEs and manufacturing firms. Qilin’s use of AI-generated scripts marks a significant development, enabling less technically skilled affiliates to deploy complex attacks with minimal effort. Both groups demonstrated the ability to compromise remote access infrastructure, escalate privileges, move laterally, exfiltrate data, and disrupt recovery mechanisms. The use of double extortion and the targeting of backup systems and AD infrastructure increased the operational impact of attacks.
Mitigation & Workarounds
The following mitigation strategies are prioritized by severity:
Critical: Inventory and immediately disable unnecessary internet-accessible devices, especially VPN endpoints and remote desktop services. Enforce multi-factor authentication (MFA) on all VPN, remote desktop, and administrative accounts to prevent unauthorized access.
High: Monitor for unauthorized changes to Group Policy Objects (GPOs) and abrupt termination or disabling of backup agents such as Veeam. Apply security patches promptly, with particular attention to vulnerabilities such as CVE-2025-24799 in GLPI.
Medium: Extend access controls and monitoring to third-party vendors, subsidiaries, and overseas offices to reduce supply chain risk. Deploy endpoint detection and response (EDR) solutions capable of behavioral detection, focusing on patterns such as bulk AD enumeration, unauthorized GPO modifications, and data exfiltration via cloud storage tools.
Low: Conduct regular security awareness training for staff, emphasizing phishing and credential theft prevention. Review and update incident response plans to account for double-extortion and AI-generated attack tooling.
Indicators of Compromise
The following caveat applies: Indicators of compromise (IOCs) are point-in-time and should be validated against current threat intelligence before enforcement. No public indicators of compromise were available at the time of writing.
References
Cisco Talos Intelligence, “Ransomware incidents in Japan in the first half of 2026,” 2026-09-17, https://blog.talosintelligence.com/ransomware-incidents-in-japan-in-the-first-half-of-2026/
Cloud Security Alliance, “CSA Research Note: Japan Ransomware, Qilin AI,” 2026-09-18, https://labs.cloudsecurityalliance.org/research/csa-research-note-japan-ransomware-qilin-ai-20260918-csa-sty/
Check Point Research, “Thus Spoke The Gentlemen,” 2026, https://research.checkpoint.com/2026/thus-spoke-the-gentlemen/
About Rescana
Rescana’s third-party risk management (TPRM) platform enables organizations to continuously assess and monitor the security posture of their vendors and supply chain partners. Our platform provides actionable insights into external exposure, supports rapid identification of emerging threats, and facilitates evidence-based risk mitigation strategies relevant to ransomware and supply chain attacks.
We are happy to answer questions at info@rescana.com.
