A ransomware primer
Summary: Cisco Talos outlines risk mitigation strategies including Microsoft's secure administrative host guidance, Read Only Domain Controllers where multiple Active Directory Domain controllers exist, and incident response retainers for organizations without a dedicated IR team, alongside NIST SP 800-53 as a controls reference. The document also reports 134 ransomware incidents in Japan in 2025, a 17.5% year-over-year increase, with The Gentlemen the most active group and its leak-site listings more than doubling from January to July, Qilin second and appearing to use AI, SMEs with capital under JPY 1 billion making up 80% of victims, and the Chaos group using new malware 'msaRAT' that hijacks browsers and connects through the browser rather than directly to C2, hiding the attacker's IP via WebRTC over TURN.
What you should know: SMEs with capital under JPY 1 billion accounted for 80% of Japan's ransomware victims, and a browser-hijacking tool like msaRAT that never talks directly to command-and-control gives defenders far less to detect on.
Read the original at Cisco Talos ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026