# Ransomware Incidents Surge 4.7% in Japan H1 2026: The Gentlemen and Qilin Lead, AI-Assisted Tooling Observed

> Cisco Talos documented 90 ransomware incidents against Japanese organizations between January and July 2026 (+4.7% YoY), led by The Gentlemen RaaS (14 incidents, Russian-speaking operators) and Qilin (7 incidents, using Python attack scripts with medium-to-high confidence signs of LLM-assisted generation). Attackers exploited a GLPI SQL injection flaw (CVE-2025-24799) and Zerologon (CVE-2020-1472) for initial access and privilege escalation, disproportionately hitting manufacturing and sub-JPY-1-billion-capital organizations.

- **Published:** 2026-09-17T00:00:00Z
- **Last reviewed:** 2026-09-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2546
- **ID:** TL-2026-2546
- **Severity:** HIGH (CVSS 9.8)
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** The Gentlemen (Russia)
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-24799, CVE-2025-2479, CVE-2020-1472

## Description

Cisco Talos' analysis of ransomware activity against Japanese organizations for the first half of 2026 recorded 90 incidents (January-July), a 4.7% year-over-year increase, peaking at 19 incidents in April 2026. The Gentlemen RaaS operation was the most active group targeting Japan with 14 incidents; its data-leak-site listings grew 2.2x (48 to 105) over the reporting window. The Gentlemen (tracked by Microsoft as Storm-2697) emerged around July 2025 as a private operation before formally standing up an affiliate RaaS model in September 2025; the operation was previously known as ArmCorp, a former affiliate of the Qilin ransomware operation (tracked by Unit 42 as Spikey Scorpius) before a dispute over roughly $48,000 in unpaid commissions. The Gentlemen's ransomware is a Go-based, self-propagating encryptor: invoked with a `--spread` argument it attempts 21 distinct remote-execution methods per target host (including PsExec, WMI, scheduled tasks, Windows services, and PowerShell remoting) staged from both the source host's SMB share and the target's local staging directory. Encryption uses a hybrid Curve25519 ECDH + XChaCha20 stream-cipher scheme with per-file ephemeral keypairs; files under 1MB are fully encrypted, larger files are partially encrypted across three chunks. Confirmed artifacts include the `.umc16h` file extension, the ransom note `README-GENTLEMEN.txt`, the wallpaper `gentlemen.bmp`, scheduled tasks named `gentlemen_system`/`UpdateSystem`/`UpdateUser`, and registry persistence keys `GupdateS` (HKLM) and `GupdateU` (HKCU). The group also fields a dedicated EDR-killer framework ('GentleKiller') and has offered affiliates an unusually high 90% payout share.

Qilin's contribution to the Japan incident set (7 incidents) is notable for a novel AI-assisted TTP: three Python attack scripts recovered from incidents -- `deadman.py` (a dead-man's-switch wiper that stages a payload and startup script to SYSVOL and creates a Group Policy Object on the domain controller to push the wiper domain-wide), `veeam_kill.py` (stops, disables, and destroys Veeam backup infrastructure), and `deploy_locker.py` (distributes and executes the ransomware locker across endpoints) -- exhibit medium-to-high confidence indicators of LLM-generated code: workflow-structured comments (e.g., '# Stage wipe payload to SYSVOL', '# Stage startup script', '# Create GPO via PowerShell on DC') and documentation-style headers describing purpose, prerequisites, and usage examples, a pattern typical of code generated from a natural-language specification rather than hand-written by an operator. Bash history recovered from a compromised host referenced a locally described 'llm_chatbot' tool, consistent with an LLM being used operationally during the intrusion rather than only during offline tool development.

Initial access and privilege escalation across the incident set combined exploitation of an unauthenticated SQL injection vulnerability in GLPI's inventory endpoint (CVE-2025-24799, via both a public PoC and sqlmap) with exploitation of the Zerologon Netlogon elevation-of-privilege flaw (CVE-2020-1472) to obtain domain administrator access, plus traces suggesting exploitation of the MS17-010 (EternalBlue-class) SMB vulnerabilities. Talos also cited a second SQL injection identifier, CVE-2025-2479, described only as 'a SQL injection vulnerability that can allow unauthorized manipulation of databases'; the current NVD record for CVE-2025-2479 corresponds to an unrelated WordPress plugin (Easy Custom Admin Bar) reflected XSS issue, so this appears to be a citation error or CVE-number transposition in the source article rather than a second confirmed GLPI flaw, and is documented here without asserting a specific affected product.

Post-exploitation tradecraft was consistent across both groups: AD reconnaissance and credential harvesting via RustHound, BloodHound, and NetExec; NTLM relay via Responder and impacket-partial-mic; credential dumping (ntds.dit, SAM/SYSTEM hives, secretsdump.py); multi-hop network tunneling via Ligolo-ng, chisel, and Proxychains; remote access via AnyDesk; and command-and-control via the open-source AdaptixC2 framework (used by The Gentlemen). Exfiltration was performed by mounting Windows backup shares over CIFS, inspecting VHDX backup files, and uploading zstd-compressed, chunked data (up to 16 concurrent transfers) via Rclone to Wasabi cloud storage. Russian-language Bash comments and Cyrillic keyboard-layout artifacts (mistyped commands such as 'црщфьш' for 'whoami', 'ды' for 'ls', and 'шз ф' for 'ip a') recovered from attacker shell history support an assessment of Russian-speaking operators behind The Gentlemen. Manufacturing organizations (34% of Japan incidents; 21% of The Gentlemen's global leak-site victims) and organizations capitalized below JPY 1 billion (78% of Japan victims) were disproportionately targeted; 13.3% of victims had overseas subsidiaries affected, primarily in Taiwan, the US, and the Philippines.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1548 Abuse Elevation Control Mechanism
- T1021.002 SMB/Windows Admin Shares
- T1021.001 Remote Desktop Protocol
- T1570 Lateral Tool Transfer
- T1046 Network Service Discovery
- T1003.006 DCSync
- T1003.001 LSASS Memory
- T1552 Unsecured Credentials
- T1572 Protocol Tunneling
- T1059.006 Python
- T1053.005 Scheduled Task
- T1484.001 Group Policy Modification
- T1490 Inhibit System Recovery
- T1561 Disk Wipe
- T1489 Service Stop
- T1567.002 Exfiltration to Cloud Storage

## Sources

- [Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen's infrastructure and evidence of Qilin's AI use](https://blog.talosintelligence.com/ransomware-incidents-in-japan-in-the-first-half-of-2026/)
- [The Gentlemen ransomware: Dissecting a self-propagating Go encryptor](https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/)
- [No Manners Here: The Ruthless Rise of The Gentlemen Ransomware](https://unit42.paloaltonetworks.com/the-gentlemen-ransomware/)
- [The Gentlemen Ransomware - Threat Profile](https://blackpointcyber.com/threat-profile/gentlemen-ransomware/)
- [Thus Spoke...The Gentlemen](https://research.checkpoint.com/2026/thus-spoke-the-gentlemen/)
- [The Gentlemen RaaS: rapid growth and a new ransomware variant](https://securelist.com/the-gentlemen-raas/120447/)
- [The Gentlemen Threat Actor Profile: Tactics and Operations](https://gurucul.com/blog/threat-actor-profile-the-gentlemen/)
- [The Gentlemen Ransomware Group Is Scaling Faster Than Any Other Group on Record](https://www.halcyon.ai/ransomware-research-reports/threat-assessment-the-gentlemen-ransomware-group)
- [GLPI < 10.0.17 - Pre-Auth SQL Injection (CVE-2025-24799)](https://pentest-tools.com/vulnerabilities-exploits/glpi-10017-pre-auth-sql-injection_26946)
- [Pre-authentication SQL Injection to RCE in GLPI](https://kudelskisecurity.com/research/pre-authentication-sql-injection-to-rce-in-glpi)
- [CVE-2025-24799: GLPI allows unauthenticated SQL injection through the inventory endpoint](https://cvefeed.io/vuln/detail/CVE-2025-24799)
- [CVE-2025-24799 - SQL injection vulnerability in GLPI](https://www.broadcom.com/support/security-center/protection-bulletin/cve-2025-24799-sql-injection-vulnerability-in-glpi)
- [Known Exploited Vulnerabilities Catalog (CVE-2020-1472)](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1472)
- [AdaptixC2 Uncovered: Capabilities, Tactics & Hunting Strategies](https://hunt.io/blog/adaptixc2-uncovered-capabilities-tactics-hunting)
- [AdaptixC2: A New Open-Source Framework Leveraged in Real-World Attacks](https://unit42.paloaltonetworks.com/adaptixc2-post-exploitation-framework/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2546