Ransomware Incidents Surge 4.7% in Japan H1 2026: The Gentlemen and Qilin Lead, AI-Assisted Tooling Observed
Ransomware Incidents Surge 4.7% in Japan H1 2026 (TL-2026-2546) is a high-severity ransomware operation scored CVSS 9.8, first published 2026-09-17. It is attributed to The Gentlemen (Russia) with medium confidence, affects glpi-project GLPI, references 3 CVEs (CVE-2025-24799, CVE-2025-2479, CVE-2020-1472), maps to 17 MITRE ATT&CK techniques (T1003.001, T1003.006, T1021.001), and is covered by 9 detection rules and 26 indicators of compromise.
Key facts for TL-2026-2546
- Threat ID
- TL-2026-2546
- Severity
- HIGH
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-09-17
- Last reviewed
- 2026-09-17
- Attribution
- The Gentlemen
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, professional-scientific-technical-services, wholesale-trade, retail-trade, construction, healthcare-social-assistance
- Target regions
- japan, taiwan, united states of america, philippines
- Detection rules
- 9
- Indicators of compromise
- 26
Malware and tooling in Ransomware Incidents Surge 4.7% in Japan H1 2026
Malware and tooling: AdaptixC2, AgendaCrypt, AnyDesk, Python, Qilin ransomware, Responder, The Gentlemen ransomware, safepay, AdaptixC2, AnyDesk, BloodHound - S0521, Chisel
Cisco Talos documented 90 ransomware incidents against Japanese organizations between January and July 2026 (+4.7% YoY), led by The Gentlemen RaaS (14 incidents, Russian-speaking operators) and Qilin (7 incidents, using Python attack scripts with medium-to-high confidence signs of LLM-assisted generation). Attackers exploited a GLPI SQL injection flaw (CVE-2025-24799) and Zerologon (CVE-2020-1472) for initial access and privilege escalation, disproportionately hitting manufacturing and sub-JPY-1-billion-capital organizations.
How Ransomware Incidents Surge 4.7% in Japan H1 2026 works
Cisco Talos' analysis of ransomware activity against Japanese organizations for the first half of 2026 recorded 90 incidents (January-July), a 4.7% year-over-year increase, peaking at 19 incidents in April 2026. The Gentlemen RaaS operation was the most active group targeting Japan with 14 incidents; its data-leak-site listings grew 2.2x (48 to 105) over the reporting window. The Gentlemen (tracked by Microsoft as Storm-2697) emerged around July 2025 as a private operation before formally standing up an affiliate RaaS model in September 2025; the operation was previously known as ArmCorp, a former affiliate of the Qilin ransomware operation (tracked by Unit 42 as Spikey Scorpius) before a dispute over roughly $48,000 in unpaid commissions. The Gentlemen's ransomware is a Go-based, self-propagating encryptor: invoked with a `--spread` argument it attempts 21 distinct remote-execution methods per target host (including PsExec, WMI, scheduled tasks, Windows services, and PowerShell remoting) staged from both the source host's SMB share and the target's local staging directory. Encryption uses a hybrid Curve25519 ECDH + XChaCha20 stream-cipher scheme with per-file ephemeral keypairs; files under 1MB are fully encrypted, larger files are partially encrypted across three chunks. Confirmed artifacts include the `.umc16h` file extension, the ransom note `README-GENTLEMEN.txt`, the wallpaper `gentlemen.bmp`, scheduled tasks named `gentlemen_system`/`UpdateSystem`/`UpdateUser`, and registry persistence keys `GupdateS` (HKLM) and `GupdateU` (HKCU). The group also fields a dedicated EDR-killer framework ('GentleKiller') and has offered affiliates an unusually high 90% payout share.
Qilin's contribution to the Japan incident set (7 incidents) is notable for a novel AI-assisted TTP: three Python attack scripts recovered from incidents -- `deadman.py` (a dead-man's-switch wiper that stages a payload and startup script to SYSVOL and creates a Group Policy Object on the domain controller to push the wiper domain-wide), `veeam_kill.py` (stops, disables, and destroys Veeam backup infrastructure), and `deploy_locker.py` (distributes and executes the ransomware locker across endpoints) -- exhibit medium-to-high confidence indicators of LLM-generated code: workflow-structured comments (e.g., '# Stage wipe payload to SYSVOL', '# Stage startup script', '# Create GPO via PowerShell on DC') and documentation-style headers describing purpose, prerequisites, and usage examples, a pattern typical of code generated from a natural-language specification rather than hand-written by an operator. Bash history recovered from a compromised host referenced a locally described 'llm_chatbot' tool, consistent with an LLM being used operationally during the intrusion rather than only during offline tool development.
Initial access and privilege escalation across the incident set combined exploitation of an unauthenticated SQL injection vulnerability in GLPI's inventory endpoint (CVE-2025-24799, via both a public PoC and sqlmap) with exploitation of the Zerologon Netlogon elevation-of-privilege flaw (CVE-2020-1472) to obtain domain administrator access, plus traces suggesting exploitation of the MS17-010 (EternalBlue-class) SMB vulnerabilities. Talos also cited a second SQL injection identifier, CVE-2025-2479, described only as 'a SQL injection vulnerability that can allow unauthorized manipulation of databases'; the current NVD record for CVE-2025-2479 corresponds to an unrelated WordPress plugin (Easy Custom Admin Bar) reflected XSS issue, so this appears to be a citation error or CVE-number transposition in the source article rather than a second confirmed GLPI flaw, and is documented here without asserting a specific affected product.
Post-exploitation tradecraft was consistent across both groups: AD reconnaissance and credential harvesting via RustHound, BloodHound, and NetExec; NTLM relay via Responder and impacket-partial-mic; credential dumping (ntds.dit, SAM/SYSTEM hives, secretsdump.py); multi-hop network tunneling via Ligolo-ng, chisel, and Proxychains; remote access via AnyDesk; and command-and-control via the open-source AdaptixC2 framework (used by The Gentlemen). Exfiltration was performed by mounting Windows backup shares over CIFS, inspecting VHDX backup files, and uploading zstd-compressed, chunked data (up to 16 concurrent transfers) via Rclone to Wasabi cloud storage. Russian-language Bash comments and Cyrillic keyboard-layout artifacts (mistyped commands such as 'црщфьш' for 'whoami', 'ды' for 'ls', and 'шз ф' for 'ip a') recovered from attacker shell history support an assessment of Russian-speaking operators behind The Gentlemen. Manufacturing organizations (34% of Japan incidents; 21% of The Gentlemen's global leak-site victims) and organizations capitalized below JPY 1 billion (78% of Japan victims) were disproportionately targeted; 13.3% of victims had overseas subsidiaries affected, primarily in Taiwan, the US, and the Philippines.
MITRE ATT&CK techniques used in TL-2026-2546
Credential Access
T1003.001 LSASS Memory; T1003.006 DCSync; T1552 Unsecured Credentials
Lateral Movement
T1021.001 Remote Desktop Protocol; T1021.002 SMB/Windows Admin Shares; T1570 Lateral Tool Transfer
Discovery
T1046 Network Service Discovery
Persistence
Execution
Initial Access
T1190 Exploit Public-Facing Application
defense-impairment
T1484.001 Group Policy Modification
Impact
T1489 Service Stop; T1490 Inhibit System Recovery; T1561 Disk Wipe
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Command and Control
Affected products and versions in Ransomware Incidents Surge 4.7% in Japan H1 2026
- glpi-project — GLPI
Vulnerable versions: 10.0.0-10.0.17
Fixed in: 10.0.18 - Microsoft — Windows Server (Netlogon/MS-NRPC)
Vulnerable versions: 2008 R2 SP1; 2012; 2012 R2; 2016; 2019; 1903; 1909; 2004; 20H2
Fixed in: August 2020 security update - Unconfirmed — SQL injection vulnerability cited by Talos as CVE-2025-2479 ('unauthorized manipulation of databases'); the current NVD record for this CVE ID maps to an unrelated WordPress plugin (Easy Custom Admin Bar) XSS issue, indicating a likely CVE-citation error in the source article rather than a confirmed second flaw
Remediation for Ransomware Incidents Surge 4.7% in Japan H1 2026
Patches
- GLPI 10.0.18 (fixes CVE-2025-24799)
- Microsoft's August 2020 Zerologon security update (fixes CVE-2020-1472)
Immediate actions
- Patch GLPI to version 10.0.18 or later to close the unauthenticated SQL injection in the inventory endpoint (CVE-2025-24799)
- Apply Microsoft's Zerologon security update and enforce Netlogon secure-channel enforcement mode to close CVE-2020-1472
- Restrict or remove AnyDesk and other unmanaged remote-access tools not required for business operations
- Hunt for the scheduled tasks gentlemen_system, UpdateSystem, and UpdateUser and the registry keys GupdateS (HKLM) / GupdateU (HKCU)
- Alert on unauthorized Rclone execution and outbound traffic to Wasabi and other cloud-storage endpoints
- Isolate and rebuild any host showing Cyrillic-keyboard command artifacts or unexplained bash_history references to 'llm_chatbot'
Workarounds
- Restrict network access to the GLPI inventory endpoint to trusted hosts until patched
- Enable Netlogon enforcement-mode registry configuration where immediate patching is not possible
Longer-term hardening
- Deploy EDR/NDR tuned to detect AD-enumeration tooling (BloodHound, RustHound, NetExec) and NTLM-relay activity (Responder, impacket)
- Segment networks to constrain lateral movement over SMB/RDP/WinRM and monitor for Ligolo-ng/chisel/Proxychains tunnel indicators
- Enforce MFA on VPN and all remote-access services to close credential-based initial access
- Maintain offline/immutable backups and out-of-band Veeam repository access given confirmed backup-destruction tooling (veeam_kill.py)
- Build detections for AdaptixC2 C2 traffic patterns (shared HTTP headers, port reuse, certificate fingerprints)
CVEs associated with Ransomware Incidents Surge 4.7% in Japan H1 2026
Weaknesses (CWE) in Ransomware Incidents Surge 4.7% in Japan H1 2026
CWE-89
Timeline of Ransomware Incidents Surge 4.7% in Japan H1 2026
- The Gentlemen ransomware operation first observed, initially run as a private operation (formerly ArmCorp, an ex-Qilin affiliate) before formalizing as a RaaS
- The Gentlemen begins formal affiliate recruitment under a RaaS model, per Microsoft (Storm-2697) and Unit 42 reporting
- Start of Cisco Talos' Jan-Jul 2026 monitoring window for ransomware incidents against Japanese organizations
- Monthly incident count against Japanese organizations peaks at 19, the highest of the reporting period
- Microsoft publishes technical analysis of The Gentlemen's self-propagating Go-based encryptor, detailing its --spread lateral-movement logic and Curve25519/XChaCha20 encryption scheme
- The Gentlemen's data-leak-site listings exceed 100 (108 total) and claimed victims peak at 117 for the month, per Unit 42
- End of Talos' monitoring window; The Gentlemen's Japan-linked leak-site listings had grown 2.2x (48 to 105) since January
- Unit 42 records 580 total victims across 77 countries for The Gentlemen since inception through this date
- Cisco Talos publishes 'Ransomware Incidents in Japan in the First Half of 2026', documenting 90 incidents, GLPI/Zerologon exploitation, and Qilin's LLM-assisted Python tooling
Sources cited for Ransomware Incidents Surge 4.7% in Japan H1 2026
- Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen's infrastructure and evidence of Qilin's AI use
- The Gentlemen ransomware: Dissecting a self-propagating Go encryptor
- No Manners Here: The Ruthless Rise of The Gentlemen Ransomware
- The Gentlemen Ransomware - Threat Profile
- Thus Spoke...The Gentlemen
- The Gentlemen RaaS: rapid growth and a new ransomware variant
- The Gentlemen Threat Actor Profile: Tactics and Operations
- The Gentlemen Ransomware Group Is Scaling Faster Than Any Other Group on Record
- GLPI < 10.0.17 - Pre-Auth SQL Injection (CVE-2025-24799)
- Pre-authentication SQL Injection to RCE in GLPI
- CVE-2025-24799: GLPI allows unauthenticated SQL injection through the inventory endpoint
- CVE-2025-24799 - SQL injection vulnerability in GLPI
- Known Exploited Vulnerabilities Catalog (CVE-2020-1472)
- AdaptixC2 Uncovered: Capabilities, Tactics & Hunting Strategies
- AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks
More in ransomware
- Ransomware Attack Disrupts IT Systems and Services in Ellis County, Kansas
- KRSID Ransomware Distributed via Fraudulent "UBP Asset" Home Trading System (HTS) Software
- Team Cymru Infrastructure Analysis: Seven Active Ransomware Gangs (Akira, DragonForce, Clop, MedusaLocker, Qilin, INC Ransom, Lynx) Abuse Dual-Use Tools and Exploit SonicWall, Gladinet CentreStack, and FortiGate Devices
- Pro-Ukraine 'Hacking Cat' Group Deploys Gorilla RAT, Monkey Ransomware, and Nemo Wiper Against Russian Targets via Exchange/SharePoint Exploitation
- Magniber Ransomware: Rewritten 2022 Variant Uses MSI Installer, AES-NI Encryption, and UAC Bypass
Detection coverage for TL-2026-2546
As of 2026-09-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2546 across Splunk SPL, Microsoft KQL and Sigma, covering 26 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.