Ransomware Incidents Surge 4.7% in Japan H1 2026: The Gentlemen and Qilin Lead, AI-Assisted Tooling Observed

Key facts for Gentlemen Japan H1 2026 surge

Detection coverage for Gentlemen Japan H1 2026 surge

As of 2026-09-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2546 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Active Directory Recon and Credential Dumping — RustHound/BloodHound/NetExec, DCSync, LSASS Access

Detects the post-exploitation AD-reconnaissance and credential-harvesting tradecraft observed across The Gentlemen and Qilin Japan intrusions: RustHound/BloodHound/NetExec enumeration, DCSync replication-rights abuse (secretsdump.py-class ntds.dit extraction), and LSASS memory access consistent with credential dumping.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1046, T1003.006, T1003.001, T1552
• Data sources: sysmon, windows_security, edr_process_telemetry
• Severity: high
• Confidence: high

Splunk SPL

(index=wineventlog sourcetype="WinEventLog:Security" EventCode=4662 (Properties="*1131f6ad-9c07-11d1-f79f-00c04fc2dcd2*" OR Properties="*1131f6aa-9c07-11d1-f79f-00c04fc2dcd2*") NOT SubjectUserName="*$")
| eval technique="T1003.006", detail="DCSync replication rights abuse"
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=10 TargetImage="*\\lsass.exe" (GrantedAccess="0x1010" OR GrantedAccess="0x1410" OR GrantedAccess="0x1438" OR GrantedAccess="0x143a")
      | eval technique="T1003.001", detail="LSASS memory access" ]
| append
    [ search index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (Image="*rusthound*" OR Image="*bloodhound*" OR Image="*netexec*" OR Image="*nxc.exe" OR CommandLine="*bloodhound-python*" OR CommandLine="*secretsdump.py*" OR CommandLine="*ntds.dit*")
      | eval technique="T1046/T1552", detail="AD enumeration or credential-dump tooling execution" ]
| stats count values(technique) as techniques_observed values(detail) as details min(_time) as first_seen max(_time) as last_seen by Computer, SubjectUserName, src_ip
| where count >= 1
| sort -count

Microsoft KQL

let DCSync = 
SecurityEvent
| where EventID == 4662
| where Properties has_any ("1131f6ad-9c07-11d1-f79f-00c04fc2dcd2","1131f6aa-9c07-11d1-f79f-00c04fc2dcd2")
| where SubjectUserName !endswith "$"
| project TimeGenerated, Computer, SubjectUserName, Technique="T1003.006";
let LsassAccess =
DeviceEvents
| where ActionType == "ProcessAccess" and FileName =~ "lsass.exe"
| where GrantedAccess in ("0x1010","0x1410","0x1438","0x143a")
| project TimeGenerated=Timestamp, Computer=DeviceName, SubjectUserName=InitiatingProcessAccountName, Technique="T1003.001";
let ReconTooling =
DeviceProcessEvents
| where FileName has_any ("rusthound","bloodhound","netexec","nxc.exe") or ProcessCommandLine has_any ("bloodhound-python","secretsdump.py","ntds.dit")
| project TimeGenerated=Timestamp, Computer=DeviceName, SubjectUserName=AccountName, Technique="T1046_T1552";
DCSync
| union LsassAccess
| union ReconTooling
| summarize EventCount=count(), Techniques=make_set(Technique), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by Computer, SubjectUserName
| order by EventCount desc

Sigma

title: Active Directory Recon and Credential Dumping — RustHound/BloodHound/NetExec, DCSync, LSASS Access
id: 1c4d8e70-3b9a-4f5c-8d2e-6a7c9b1e3f44
status: experimental
description: Detects the post-exploitation AD-reconnaissance and credential-harvesting tradecraft observed across The Gentlemen and Qilin Japan intrusions -- RustHound/BloodHound/NetExec enumeration, DCSync replication-rights abuse, and LSASS memory access consistent with secretsdump.py / Mimikatz-class dumping.
references:
    - https://blog.talosintelligence.com/ransomware-incidents-in-japan-in-the-first-half-of-2026/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-17
tags:
    - attack.discovery
    - attack.credential-access
    - attack.t1046
    - attack.t1003.006
    - attack.t1003.001
    - attack.t1552
    - attack.tool.bloodhound
logsource:
    category: process_creation
    product: windows
detection:
    selection_recon:
        Image|contains:
            - 'rusthound'
            - 'bloodhound'
            - 'netexec'
            - 'nxc.exe'
        CommandLine|contains:
            - 'bloodhound-python'
            - 'secretsdump.py'
            - 'ntds.dit'
    condition: selection_recon
falsepositives:
    - Authorized red-team or purple-team Active Directory assessment
level: high

Known false positives:

• Authorized red-team/purple-team AD assessments using BloodHound/NetExec
• Legitimate DC replication traffic from peer domain controller machine accounts (excluded via NOT SubjectUserName="*$")

Tuning notes: Exclude known DC and backup-service machine accounts from the DCSync leg; allowlist authorized pentest source hosts for the recon-tool process-name leg to cut noise from sanctioned assessments.

• 🔒 Zerologon Netlogon Privilege Escalation to Domain Admin (CVE-2020-1472) · unlock with TL Creds
• 🔒 The Gentlemen Self-Propagation (--spread) and Scheduled-Task Persistence · unlock with TL Creds
• 🔒 Unauthorized Portable AnyDesk Install and Multi-Hop Tunnel Pivoting · unlock with TL Creds
• 🔒 GLPI SQLi to Zerologon Privilege-Escalation Chain (Correlation) · unlock with TL Creds
• 🔒 Qilin LLM-Assisted Python Attack Tooling — Dead-Man's-Switch Wiper, Veeam Destruction, Locker Deployment · unlock with TL Creds
• 🔒 Rclone Chunked zstd Exfiltration to Wasabi Cloud Storage · unlock with TL Creds
• 🔒 GLPI Unauthenticated SQL Injection Exploitation Attempt (CVE-2025-24799) · unlock with TL Creds
• 🔒 AdaptixC2 Beacon Traffic with Concurrent NTLM Relay Activity · unlock with TL Creds

Indicators of compromise for Gentlemen Japan H1 2026 surge

As of 2026-09-17, Threadlinqs Intelligence tracks 26 indicators of compromise for TL-2026-2546.

Sample indicators (3 of 26)

• File hash: 22b38dad7da097ea03aa28d0614164cd25fafeb1383dbc15047e34c8050f6f67
• File hash: 078163d5c16f64caa5a14784323fd51451b8c831c73396b967b4e35e6879937b
• File hash: fe1033335a045c696c900d435119d210361966e2fb5cd1ba3382608cfa2c8e68

Defanged, TLP:CLEAR. Full set of 26 indicators: unlock with TL Creds.

How Gentlemen Japan H1 2026 surge works

Attackers exploited a GLPI SQL injection flaw (CVE-2025-24799) and Zerologon (CVE-2020-1472) for initial access and privilege escalation, disproportionately hitting manufacturing and sub-JPY-1-billion-capital organizations.

Cisco Talos' analysis of ransomware activity against Japanese organizations for the first half of 2026 recorded 90 incidents (January-July), a 4.7% year-over-year increase, peaking at 19 incidents in April 2026. The Gentlemen RaaS operation was the most active group targeting Japan with 14 incidents; its data-leak-site listings grew 2.2x (48 to 105) over the reporting window. The Gentlemen (tracked by Microsoft as Storm-2697) emerged around July 2025 as a private operation before formally standing up an affiliate RaaS model in September 2025; the operation was previously known as ArmCorp, a former affiliate of the Qilin ransomware operation (tracked by Unit 42 as Spikey Scorpius) before a dispute over roughly $48,000 in unpaid commissions. The Gentlemen's ransomware is a Go-based, self-propagating encryptor: invoked with a `--spread` argument it attempts 21 distinct remote-execution methods per target host (including PsExec, WMI, scheduled tasks, Windows services, and PowerShell remoting) staged from both the source host's SMB share and the target's local staging directory. Encryption uses a hybrid Curve25519 ECDH + XChaCha20 stream-cipher scheme with per-file ephemeral keypairs; files under 1MB are fully encrypted, larger files are partially encrypted across three chunks. Confirmed artifacts include the `.umc16h` file extension, the ransom note `README-GENTLEMEN.txt`, the wallpaper `gentlemen.bmp`, scheduled tasks named `gentlemen_system`/`UpdateSystem`/`UpdateUser`, and registry persistence keys `GupdateS` (HKLM) and `GupdateU` (HKCU). The group also fields a dedicated EDR-killer framework ('GentleKiller') and has offered affiliates an unusually high 90% payout share.

Qilin's contribution to the Japan incident set (7 incidents) is notable for a novel AI-assisted TTP: three Python attack scripts recovered from incidents -- `deadman.py` (a dead-man's-switch wiper that stages a payload and startup script to SYSVOL and creates a Group Policy Object on the domain controller to push the wiper domain-wide), `veeam_kill.py` (stops, disables, and destroys Veeam backup infrastructure), and `deploy_locker.py` (distributes and executes the ransomware locker across endpoints) -- exhibit medium-to-high confidence indicators of LLM-generated code: workflow-structured comments (e.g., '# Stage wipe payload to SYSVOL', '# Stage startup script', '# Create GPO via PowerShell on DC') and documentation-style headers describing purpose, prerequisites, and usage examples, a pattern typical of code generated from a natural-language specification rather than hand-written by an operator. Bash history recovered from a compromised host referenced a locally described 'llm_chatbot' tool, consistent with an LLM being used operationally during the intrusion rather than only during offline tool development.

Initial access and privilege escalation across the incident set combined exploitation of an unauthenticated SQL injection vulnerability in GLPI's inventory endpoint (CVE-2025-24799, via both a public PoC and sqlmap) with exploitation of the Zerologon Netlogon elevation-of-privilege flaw (CVE-2020-1472) to obtain domain administrator access, plus traces suggesting exploitation of the MS17-010 (EternalBlue-class) SMB vulnerabilities. Talos also cited a second SQL injection identifier, CVE-2025-2479, described only as 'a SQL injection vulnerability that can allow unauthorized manipulation of databases'; the current NVD record for CVE-2025-2479 corresponds to an unrelated WordPress plugin (Easy Custom Admin Bar) reflected XSS issue, so this appears to be a citation error or CVE-number transposition in the source article rather than a second confirmed GLPI flaw, and is documented here without asserting a specific affected product.

Post-exploitation tradecraft was consistent across both groups: AD reconnaissance and credential harvesting via RustHound, BloodHound, and NetExec; NTLM relay via Responder and impacket-partial-mic; credential dumping (ntds.dit, SAM/SYSTEM hives, secretsdump.py); multi-hop network tunneling via Ligolo-ng, chisel, and Proxychains; remote access via AnyDesk; and command-and-control via the open-source AdaptixC2 framework (used by The Gentlemen). Exfiltration was performed by mounting Windows backup shares over CIFS, inspecting VHDX backup files, and uploading zstd-compressed, chunked data (up to 16 concurrent transfers) via Rclone to Wasabi cloud storage. Russian-language Bash comments and Cyrillic keyboard-layout artifacts (mistyped commands such as 'црщфьш' for 'whoami', 'ды' for 'ls', and 'шз ф' for 'ip a') recovered from attacker shell history support an assessment of Russian-speaking operators behind The Gentlemen. Manufacturing organizations (34% of Japan incidents; 21% of The Gentlemen's global leak-site victims) and organizations capitalized below JPY 1 billion (78% of Japan victims) were disproportionately targeted; 13.3% of victims had overseas subsidiaries affected, primarily in Taiwan, the US, and the Philippines.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory; T1003.006 DCSync; T1552 Unsecured Credentials

Lateral Movement

T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares; T1570 Lateral Tool Transfer

Discovery

T1046 Network Service Discovery

Persistence

T1053.005 Scheduled Task

Execution

T1059.006 Python

Initial Access

T1190 Exploit Public-Facing Application

defense-impairment

T1484.001 Group Policy Modification

Impact

T1489 Service Stop; T1490 Inhibit System Recovery; T1561 Disk Wipe

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Exfiltration

T1567.002 Exfiltration to Cloud Storage

Command and Control

T1572 Protocol Tunneling

Remediation for Gentlemen Japan H1 2026 surge

Patches

• GLPI 10.0.18 (fixes CVE-2025-24799)
• Microsoft's August 2020 Zerologon security update (fixes CVE-2020-1472)

Immediate actions

• Patch GLPI to version 10.0.18 or later to close the unauthenticated SQL injection in the inventory endpoint (CVE-2025-24799)
• Apply Microsoft's Zerologon security update and enforce Netlogon secure-channel enforcement mode to close CVE-2020-1472
• Restrict or remove AnyDesk and other unmanaged remote-access tools not required for business operations
• Hunt for the scheduled tasks gentlemen_system, UpdateSystem, and UpdateUser and the registry keys GupdateS (HKLM) / GupdateU (HKCU)
• Alert on unauthorized Rclone execution and outbound traffic to Wasabi and other cloud-storage endpoints
• Isolate and rebuild any host showing Cyrillic-keyboard command artifacts or unexplained bash_history references to 'llm_chatbot'

Workarounds

• Restrict network access to the GLPI inventory endpoint to trusted hosts until patched
• Enable Netlogon enforcement-mode registry configuration where immediate patching is not possible

Longer-term hardening

• Deploy EDR/NDR tuned to detect AD-enumeration tooling (BloodHound, RustHound, NetExec) and NTLM-relay activity (Responder, impacket)
• Segment networks to constrain lateral movement over SMB/RDP/WinRM and monitor for Ligolo-ng/chisel/Proxychains tunnel indicators
• Enforce MFA on VPN and all remote-access services to close credential-based initial access
• Maintain offline/immutable backups and out-of-band Veeam repository access given confirmed backup-destruction tooling (veeam_kill.py)
• Build detections for AdaptixC2 C2 traffic patterns (shared HTTP headers, port reuse, certificate fingerprints)

Affected and fixed versions

• glpi-project — GLPI
  Vulnerable versions: 10.0.0-10.0.17
  Fixed in: 10.0.18
• Microsoft — Windows Server (Netlogon/MS-NRPC)
  Vulnerable versions: 2008 R2 SP1; 2012; 2012 R2; 2016; 2019; 1903; 1909; 2004; 20H2
  Fixed in: August 2020 security update
• Unconfirmed — SQL injection vulnerability cited by Talos as CVE-2025-2479 ('unauthorized manipulation of databases'); the current NVD record for this CVE ID maps to an unrelated WordPress plugin (Easy Custom Admin Bar) XSS issue, indicating a likely CVE-citation error in the source article rather than a confirmed second flaw

Timeline of Gentlemen Japan H1 2026 surge

• 2025-07-01 locked-ioc-4 operation first observed, initially run as a private operation (formerly locked-ioc-22, an ex-Qilin affiliate) before formalizing as a RaaS
• 2025-09-01 The Gentlemen begins formal affiliate recruitment under a RaaS model, per Microsoft (Storm-2697) and Unit 42 reporting
• 2026-01-01 Start of Cisco Talos' Jan-Jul 2026 monitoring window for ransomware incidents against Japanese organizations
• 2026-04-01 Monthly incident count against Japanese organizations peaks at 19, the highest of the reporting period
• 2026-05-28 Microsoft publishes technical analysis of The Gentlemen's self-propagating Go-based encryptor, detailing its --spread lateral-movement logic and Curve25519/XChaCha20 encryption scheme
• 2026-06-01 The Gentlemen's data-leak-site listings exceed 100 (108 total) and claimed victims peak at 117 for the month, per Unit 42
• 2026-07-01 End of Talos' monitoring window; The Gentlemen's Japan-linked leak-site listings had grown 2.2x (48 to 105) since January
• 2026-07-07 Unit 42 records 580 total victims across 77 countries for The Gentlemen since inception through this date
• 2026-09-17 Cisco Talos publishes 'Ransomware Incidents in Japan in the First Half of 2026', documenting 90 incidents, GLPI/Zerologon exploitation, and Qilin's LLM-assisted Python tooling

Sources cited for Gentlemen Japan H1 2026 surge

Showing 15 of 17 sources, primary sources first.

• CVE-2025-24799: GLPI allows unauthenticated SQL injection through the inventory endpoint cvefeed.io · Advisory · 2025-01-01
• CVE-2025-24799 - SQL injection vulnerability in GLPI broadcom.com · Advisory · 2025-01-01
• Known Exploited Vulnerabilities Catalog (CVE-2020-1472) CISA · Government advisory · 2021-11-03
• The Gentlemen ransomware: Dissecting a self-propagating Go encryptor Microsoft · Vendor report · 2026-05-28
• No Manners Here: The Ruthless Rise of The Gentlemen Ransomware Unit 42 · Research · 2026-01-01
• The Gentlemen Ransomware - Threat Profile blackpointcyber.com · Vendor report · 2026-01-01
• Thus Spoke...The Gentlemen Check Point Research · Research · 2026-01-01
• The Gentlemen RaaS: rapid growth and a new ransomware variant Kaspersky Securelist · Research · 2026-01-01
• The Gentlemen Ransomware Group Is Scaling Faster Than Any Other Group on Record halcyon.ai · Research · 2026-01-01
• Pre-authentication SQL Injection to RCE in GLPI kudelskisecurity.com · Research · 2025-01-01
• AdaptixC2 Uncovered: Capabilities, Tactics & Hunting Strategies hunt.io · Research · 2026-01-01
• AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks Unit 42 · Research · 2026-01-01
• GLPI < 10.0.17 - Pre-Auth SQL Injection (CVE-2025-24799) pentest-tools.com · Proof of concept · 2025-01-01
• Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen's infrastructure and evidence of Qilin's AI use Cisco Talos · Blog · 2026-09-17
• The Gentlemen Threat Actor Profile: Tactics and Operations gurucul.com · Blog · 2026-01-01

Threats related to Gentlemen Japan H1 2026 surge

• Gentlemen Ransomware (Storm-2697): Double-Extortion RaaS with Fortinet Exploitation, BYOVD EDR Killers and GPO-Based Mass Deployment

More from The Gentlemen

• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• 2026 Dark Web Threat Trends: Infostealer Credential Markets, Ransomware Splintering, Deepfake KYC Bypass (JINKUSU CAM), Telegram Resilience, SaaS/Identity Breaches
• Unit 42: Retail Peak Season Cyber Threats - Ransomware/Extortion, DDoS, Digital Skimming, Account Takeover and AI-Assisted Intrusion (CVE-2024-34102, CVE-2021-44228)
• Ransomware Surge in Q3 2026: The Gentlemen Overtakes Qilin as Rival Gangs Compete for Market Share
• Rapid7 Q3 2026 Threat Landscape: High-Severity Flaws Exploited in 3 Days as The Gentlemen and Qilin Ransomware Dominate
• Bitdefender Threat Debrief June 2026: Ransomware Landscape (Qilin, The Gentlemen, DragonForce, KryBit) and Actively Exploited SolarWinds Serv-U Flaw CVE-2026-28318

Previous and next in ransomware

• Team Cymru Infrastructure Analysis: Seven Active Ransomware Gangs (Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, Lynx) Abuse Dual-Use Tools and Exploit SonicWall, Gladinet CentreStack, and FortiGate Devices Previous report
• KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home Trading System (HTS) Software Next report

Further reading

• Edge RCEs: Cisco SD-WAN, Fortinet, NGINX, Exim