Japanese Ransomware Activity: The Gentlemen and Qilin

Ransomware activity affecting Japanese organizations remained high during the first half of 2026, while the groups appearing most often changed substantially from the previous year. In research published by Cisco Talos, 90 organizations in Japan were identified as ransomware victims between January and July, compared with 86 during the same period a year earlier. The increase was approximately 4.7%.

The findings point to two related trends. First, smaller organizations remain an important target population, particularly in manufacturing and connected supply chains. Second, ransomware operations continue to mature as structured intrusions rather than isolated encryption events. Talos’ investigation of The Gentlemen describes reconnaissance, network tunneling, Active Directory discovery, credential collection, lateral movement and large-scale data transfer. Its separate analysis of Qilin identifies code characteristics that, with medium-to-high confidence, suggest the use of generative AI during tool development.

These observations do not establish that every incident followed the same sequence, nor do they prove that AI independently conducted an attack. They do, however, provide useful indicators for organizations reviewing internet-facing exposure, identity controls, backup protection and detection coverage.

Who was affected

Manufacturing was the most affected sector in Talos’ Japan dataset, accounting for 34% of incidents. Information and communications organizations represented 11%, while services organizations accounted for 9%. The concentration is significant because manufacturing environments often connect corporate IT, operational processes, suppliers and overseas subsidiaries, creating multiple paths through which an intrusion can affect business operations.

Smaller organizations were particularly prominent. Companies with capital below JPY 100 million represented 48% of identified victims, and those with capital between JPY 100 million and less than JPY 1 billion represented another 30%. Together, organizations below JPY 1 billion accounted for 78% of victims, up from 69% in the comparable 2025 period. Talos interprets this as evidence that attackers are increasingly focusing on small and medium-sized enterprises.

Thirteen-point-three percent of the incidents involved overseas offices or subsidiaries. Taiwan had the highest number of cases in that category, followed by the United States and the Philippines, which had the same number of identified incidents. These figures reinforce the need to apply identity, logging and vulnerability-management standards consistently across headquarters, subsidiaries and third-party environments.

The Gentlemen’s expanding operation

Talos identified The Gentlemen as the most frequently observed ransomware group in Japan during the period, with 14 incidents. The group has reportedly operated since around July 2025 and uses a ransomware-as-a-service model. Its stated operating pattern is double extortion: data is encrypted and victims are threatened with publication of stolen information.

The group’s leak-site activity also increased. Worldwide listings rose from 48 in January to 105 in July 2026. Talos recorded a sharp increase in February, relative stability from March through May, and more than 100 listings in both June and July. Listing volume is not a direct measure of successful intrusions or total victims, but the upward pattern is consistent with an increasingly active operation.

Manufacturing accounted for 21% of The Gentlemen’s observed victims, followed by professional, scientific and technical services at 16% and wholesale trade at 13%. Cases also appeared in retail, construction, health care and social assistance, information, finance and insurance, transportation and warehousing, and education. The group therefore does not appear to be limited to one narrowly defined vertical.

What the observed intrusion workflow shows

Talos examined an open directory associated with infrastructure believed to have been used by a threat actor linked to The Gentlemen. The researchers found tools associated with both Windows and ESXi environments, as well as utilities for network discovery, Active Directory analysis, tunneling, remote access and file transfer. The presence of a tool in the directory does not by itself prove that it was successfully used against a particular victim; the broader sequence was inferred from command-history traces.

The apparent operation began by preparing an attacker-controlled server as a platform for access. VPN software and tunneling utilities, including Chisel and Ligolo-ng, were used to create routes into internal networks. Reconnaissance tools such as Nmap and Masscan were then used to examine publicly exposed hosts, VPN-related ports, web services, SMB and other active services.

After internal access was available, the actor appears to have enumerated SMB shares, hosts, LDAP data and domain information with tools including NetExec. RustHound and BloodHound-related tooling was reportedly used, or prepared for use, to collect information about users, groups, computers, administrative privileges and trust relationships. The purpose was to identify possible routes for privilege escalation and lateral movement.

Talos also observed attempts involving publicly exposed web services and administrative interfaces. The report identifies exploitation activity targeting GLPI through the unauthenticated SQL injection vulnerability CVE-2025-24799, including use of a proof of concept and sqlmap to retrieve user information. The researchers also found a scanner aimed at cPanel/WHM and a proof of concept used to test authentication-bypass vulnerabilities. The supplied research does not establish that every attempted exploit resulted in access.

Within Windows and Active Directory environments, the actor used or installed tools associated with credential interception, NTLM relay, remote authentication and lateral movement. Talos also observed traces suggesting exploitation of CVE-2020-1472, known as Zerologon, and vulnerabilities associated with MS17-010. These observations make patch status and exposure of legacy services especially important, although the report does not attribute a confirmed successful compromise to each individual vulnerability.

The later stages focused on privileged access, backup data and credential material. The actor mounted a backup share through CIFS and inspected VHDX files. The command history shows collection of ntds.dit, SAM and SYSTEM files, followed by credential extraction with secretsdump.py. The VHDX material was compressed, divided into 256 MiB segments and transferred to cloud storage using Rclone. The recorded configuration included concurrent transfers, retries, timeouts and logging, indicating deliberate preparation for moving large quantities of data.

Talos also found evidence of cleanup on the attacker-controlled server, including deletion of credential dumps, scan results, tunneling tools, Responder-related files and temporary material. The group was additionally linked to the open-source AdaptixC2 framework, which supports multiple agents, listeners and communication protocols. The report notes that AdaptixC2 can use HTTP/S, DNS over HTTPS and SMB, making it adaptable to different network conditions. Its presence should be treated as an investigative lead rather than proof of a particular intrusion by itself.

Attribution remains an assessment

Talos found Russian-language comments in a Bash script and keyboard-layout artifacts in a recorded command history. The researchers assessed that these traces suggest a Russian-speaking individual may have been involved. They also stated that the evidence is consistent with an existing suspicion that The Gentlemen is led by individuals based in Russia.

This is an assessment, not a definitive identification of the operators or their location. Language, keyboard layout and infrastructure artifacts can support clustering, but they should not be treated as conclusive attribution without additional evidence.

Qilin and possible AI-assisted development

Qilin recorded the second-highest number of observed incidents in the Talos dataset, with seven, matching SafePay. Talos’ more distinctive finding concerns Python scripts located in an open directory associated with a Qilin-affected environment.

With medium-to-high confidence, Talos assessed that several scripts may have been generated with assistance from a large language model. The examples included deadman.py, which was designed to coordinate destructive actions across Windows and Active Directory systems; veeam_kill.py, which was intended to stop, disable or destroy Veeam backups; and deploy_locker.py, which was used to distribute and execute ransomware across multiple endpoints. The scripts contained structured stages, explanatory comments, progress messages and documentation-like usage text. Command history also showed inspection of a directory associated with an llm_chatbot tool.

The significance is operational rather than sensational. AI-assisted coding may help an operator produce organized scripts more quickly or adapt tools to an environment. It does not mean that the intrusion was autonomous, that the generated code was necessarily sophisticated, or that AI was responsible for the entire attack. Defenders should focus on behavior: attempts to alter Group Policy, distribute scripts through domain infrastructure, disable backup services, delete shadow copies, and make coordinated changes across many endpoints.

What organizations should do now

• Inventory internet-facing services. Maintain a current list of VPN gateways, remote desktop services, web applications, management interfaces, network devices and cloud-connected systems. Disable unused services and restrict administrative interfaces by source network where practical.
• Prioritize exposure and patching. Review systems affected by CVE-2025-24799, CVE-2020-1472 and vulnerabilities associated with MS17-010, based on the organization’s actual software and configuration. Monitor vendor advisories, replace unsupported devices and validate that remediation is effective.
• Strengthen identity controls. Require multifactor authentication for VPN, cloud, remote access and administrative accounts. Remove stale and shared accounts, separate routine and privileged identities, and minimize administrative permissions.
• Monitor for intrusion behavior. Alert on unusual remote access, new or anomalous administrative accounts, extensive SMB or LDAP enumeration, tunneling from external systems, suspicious credential-dump activity and access to backup shares. Review authentication from unusual locations or at unusual times.
• Protect recovery systems. Monitor attempts to stop backup services, modify backup repositories, remove shadow copies or alter Group Policy. Keep resilient recovery copies with access controls that are separate from ordinary domain administration, and test restoration regularly.
• Extend controls to suppliers and subsidiaries. Limit third-party access by scope and duration, require multifactor authentication, retain connection logs and apply equivalent vulnerability and account standards to overseas locations.
• Preserve evidence. Because Talos found cases where the initial access vector could not be determined, retain VPN, identity, endpoint, firewall, cloud and administrative logs long enough to support investigation. Cisco Talos also lists Snort 2 SID 1:67111 and Snort 3 SID 7:29 as coverage for the reported threat.

Conclusion

Cisco Talos’ research shows a Japanese ransomware environment in which smaller organizations, manufacturing companies and connected external environments remain exposed to organized intrusion activity. The Gentlemen’s observed workflow combined internet reconnaissance, identity discovery, network pivoting, credential collection, backup access and exfiltration. Qilin’s scripts, meanwhile, suggest that AI-assisted development may be lowering the effort required to assemble destructive operational tooling.

The practical response is not to search for one signature or assume that AI changes every defensive principle. Organizations should reduce external exposure, harden identities, monitor administrative and backup activity, preserve investigation data and ensure that recovery paths remain available even after domain-level compromise.

Sources

Cisco Talos: Ransomware incidents in Japan in the first half of 2026