An overview of ransomware threats in Japan in 2025 and early detection insights from Qilin cases
Summary: Cisco Talos reported 134 ransomware incidents in Japan in 2025, a 17.5% year-over-year increase, with manufacturing accounting for 28% of affected organizations and small- and medium-sized enterprises making up 57% of victims. Qilin was the most frequently observed group at 16.4% of incidents, roughly four times the cases attributed to Lynx, and Talos found ransomware execution occurred on average about six days after initial compromise.
Why it matters: Talos found a Qilin affiliate using an EDR killer capable of disabling over 300 different EDR drivers, and with roughly six days between initial access and encryption, the window to catch the intrusion depends on detecting common commands like net user before the payload lands.
Read the original at Cisco Talos ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026