Crypt0l0cker (Torrent Locker): Old Dog, New Tricks
Summary: Ransomware incidents in Japan reached 134 in 2025, a 17.5% year-over-year increase, with The Gentlemen the most active group and its leak-site listings more than doubling from January to July. Qilin ranked second and appeared to use AI, while SMEs with capital under JPY 1 billion made up 80% of victims, and the Chaos group's new "msaRAT" malware hijacks browsers, connecting through the browser rather than directly to C2 and hiding the attacker's IP via WebRTC over TURN.
Bottom line: Four in five victims were small and mid-sized firms with under JPY 1 billion in capital, and msaRAT's browser-based routing means the traffic reaching your network may never touch an IP you can block.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026