Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
Summary: Cisco Talos recorded 90 ransomware incidents affecting Japanese organizations from January to July 2026, up about 4.7% from 86 in the same period last year, with April the highest month at 19. The Gentlemen was the most observed group with 14 incidents, followed by Qilin and SafePay with seven each, and organizations with capital under JPY 1 billion made up 78% of victims, up from 69% in 2025.
What's compelling: The Gentlemen's leak-site listings rose from 48 in January to 105 in July, roughly 2.2 times, and Talos found Russian-language keyboard traces in the actor's command history, tying the group to Russian-speaking operators. Nearly eight in ten victims were small and mid-sized firms, the segment least likely to staff a detection and response capability.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026