Threat reportRansomwareTL-2026-3626
Japan Cyber Emergency: Nationwide Ransomware and Data Theft Incidents, Qilin Operation Using Possibly AI-Generated Python Scripts
Japan Cyber Emergency (TL-2026-3626), also tracked as Japan Cyber Emergency 2026, is a high-severity ransomware operation, first published 2026-10-15. It is attributed to Qilin with medium confidence, affects Microsoft Windows Active Directory / Group Policy environments, references 1 CVE (CVE-2025-24799), maps to 18 MITRE ATT&CK techniques (T1003.003, T1021.002, T1046), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 18MITRE ATT&CK
- Actors
- 1Qilin
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-3626
- Threat ID
- TL-2026-3626
- Also known as
- Japan Cyber Emergency 2026, State of emergency in cyber space
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution
- Qilin
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- manufacturing, information-communications, services, retail, transport, finance, cloud-hosting, government administration
- Target regions
- japan, East Asia
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Japan Cyber Emergency
Malware and tooling: AgendaCrypt, Python, safepay, AdaptixC2, Chisel, Ligolo-ng, Rclone - S1040, Responder - S0174, RustHound, impacket-partial-mic
How Japan Cyber Emergency works
Ransomware, unauthorized access and data theft hit organizations across Japan in 2026, and officials described a 'state of emergency in cyber space'. Cisco Talos assessed with medium-to-high confidence that Python tools recovered from a Qilin-linked open directory (deadman.py, veeam_kill.py, deploy_locker.py) were written with LLM assistance.
Japan saw a sharp rise in ransomware, unauthorized access and data-theft incidents through 2026. Cisco Talos counted 90 ransomware incidents against Japanese organizations from January to July 2026, 4.7 percent above the 86 recorded in the same period of 2025. Organizations with capital under JPY 1 billion made up 78 percent of victims (69 percent a year earlier), and manufacturing was the most affected sector at 34 percent. The National Police Agency recorded 123 ransomware incidents in the first half of 2026. In Talos data The Gentlemen RaaS led Japan-specific activity with 14 incidents, followed by Qilin and SafePay with seven each.
In October 2026 the incidents turned into a government-level response. On October 7 a ransomware attack on IDC Frontier's IDCF Cloud (a SoftBank Group subsidiary) disrupted East Japan Region 1 and affected 495 companies and local governments, including government clients. BleepingComputer reported 225 encrypted databases (3.6 PB), 239 compromised hypervisors, about 16,000 sealed VM disks and 554,153 wiped snapshots. The article did not name the ransomware group. Separately, more than 20 prominent firms disclosed breaches. The Times Car breach exposed about 6.6 million member accounts, JR East exposed about 1.67 million customer email addresses, and Lawson, Daiwa Securities and Bookoff also reported leaks. Japan's government issued a warning on October 9, and Masaaki Taira, head of the National Cybersecurity Strategy Headquarters, called the situation 'a state of emergency in cyber space'. The National Cybersecurity Office told ministries, local authorities and companies to update security protection, use strong passwords and tighten supply-chain security. Per Aqua, IPA issued a security alert on October 9, NICT published a statement on October 13 on AI making application analysis and vulnerability discovery more efficient for attackers, and the National Cybersecurity Office issued guidance on October 14. The 'access neutralization' powers under Japan's active cyber defence law took effect on October 1. The sources do not conclusively attribute the October incidents (including IDCF) to Qilin, to AI-enabled tooling or to a single actor.
The AI finding comes from Cisco Talos's report on its investigation of The Gentlemen's infrastructure and evidence of Qilin's AI use. Talos recovered Python scripts from a Qilin-linked open directory. deadman.py deploys destructive actions to multiple machines in a Windows/Active Directory environment at a specified time and centrally manages their status. Its Group Policy function carries workflow comments such as 'Stage wipe payload to SYSVOL', 'Stage startup script' and 'Create GPO via PowerShell on DC'. veeam_kill.py is designed to stop, disable and destroy Veeam backups. deploy_locker.py distributes and executes the ransomware across multiple endpoints and contains documentation-style text on purpose, prerequisites and usage. Talos's basis for the LLM assessment was step-labelled structure (Step 1 to Step 4), documentation-like comments, redundant progress logging, and a .bash_history showing commands that inspected an 'llm_chatbot' directory. The same history contained Russian keyboard-layout artifacts, which Talos took to suggest a Russian-speaking operator. The findings show AI being used to speed up tool development, not to introduce new techniques, so defenders should rely on behavioral detection (unauthorized GPO changes, backup-service termination, bulk AD enumeration, SYSVOL staging) over signatures.
Alongside Qilin, Talos documented The Gentlemen's chain: tunnelling with Chisel and Ligolo-ng, scanning with Masscan and Nmap, AD collection with RustHound, BloodHound and NetExec, credential capture with Responder and impacket-partial-mic, exploitation of the GLPI SQL injection CVE-2025-24799, credential extraction (ntds.dit, SAM, SYSTEM), and rclone exfiltration to Wasabi in 256 MiB chunks. CSA reports that VPN flaws or misconfigurations, stolen credentials and exposed edge devices are the main initial access routes in Japan. The Aqua source names exposed applications, unpatched systems, supply-chain dependencies and insufficient response readiness as the weaknesses involved. No CVE, IP, domain or file hash IOC is published in any reviewed source, so the IOC set below is behavioral and tooling-based.
MITRE ATT&CK techniques used in TL-2026-3626
Credential Access
T1003.003 OS Credential Dumping: NTDS; T1557.001 Name Resolution Poisoning and SMB Relay
Lateral Movement
T1021.002 Remote Services: SMB/Windows Admin Shares
Discovery
T1046 Network Service Discovery; T1087.002 Account Discovery: Domain Account
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.006 Command and Scripting Interpreter: Python
Initial Access
T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application
defense-impairment
T1484.001 Domain or Tenant Policy Modification: Group Policy Modification; T1685 Disable or Modify Tools
Impact
T1485 Data Destruction; T1490 Inhibit System Recovery
Exfiltration
T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
Command and Control
Resource Development
T1587.001 Develop Capabilities: Malware; T1588.007 Obtain Capabilities: Artificial Intelligence
Affected products and versions in Japan Cyber Emergency
Remediation for Japan Cyber Emergency
Patches
- Patch internet-facing systems promptly, including GLPI (CVE-2025-24799) where deployed
Immediate actions
- Urgently review all internet-facing systems (VPN, RDP, admin services, web applications) and disable unused exposure
- Enforce MFA on VPNs, remote services and all administrative accounts
- Alert on unauthorized Group Policy changes, new GPO startup scripts or scheduled tasks, and files staged to SYSVOL
- Alert on termination or disabling of Veeam services and on bulk Active Directory enumeration
- Assess data exposure and verify offline or immutable backups that a domain-admin-level attacker cannot reach
Workarounds
- Restrict management interfaces and VPN portals to allow-listed sources
- Restrict write access to SYSVOL and GPO creation to a minimal set of administrators
Longer-term hardening
- Tune EDR for behavioral detection of backup disabling, privilege escalation and remote access abuse instead of relying on file hashes
- Separate administrative accounts and protect credentials
- Replace unsupported or end-of-life infrastructure
- Enforce time-limited access controls and access reviews for third-party and supply-chain vendors
- Exercise incident response readiness and containment procedures, with human oversight of consequential decisions
- Include AI-assisted attack tool development in threat models
CVEs associated with Japan Cyber Emergency
Weaknesses (CWE) in Japan Cyber Emergency
Timeline of Japan Cyber Emergency
- The Gentlemen RaaS begins operating (mid-2025 per Talos/CSA); it becomes the most active group against Japan in H1 2026. Date is approximate.
- Start of the Talos analysis window (January to July 2026): 90 ransomware incidents against Japanese organizations, versus 86 in the same period of 2025.
- Cisco Talos publishes its report assessing with medium-to-high confidence that Python tools (deadman.py, veeam_kill.py, deploy_locker.py) from a Qilin-linked open directory were LLM-assisted.
- 'Access neutralization' powers under Japan's active cyber defence law take effect.
- Ransomware attack on IDC Frontier's IDCF Cloud (about 03:40 local) disrupts East Japan Region 1 and affects 495 companies and local governments, including government clients. The group is not named in the BleepingComputer article.
- Japan's government warns of rising and increasingly sophisticated cyberattacks; Masaaki Taira calls it 'a state of emergency in cyber space'. IPA issues a security alert (per Aqua).
- NICT publishes a statement that AI makes application analysis and vulnerability discovery more efficient for attackers (per Aqua).
- National Cybersecurity Office guidance urges urgent review of internet-facing systems, data exposure and incident response readiness (date per Aqua; other outlets report instructions issued Friday October 9).
- Aqua Security publishes 'Japan's Cyber Emergency Is a Warning for the World', summarizing the incidents and the Talos AI assessment.
Sources cited for Japan Cyber Emergency
- Japan's Cyber Emergency Is a Warning for the World (Aqua Security)
- Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen's infrastructure and evidence of Qilin's AI use (Cisco Talos)
- Japan's H1 2026 Ransomware Surge Hits SMEs, Qilin Uses AI Scripts (CSA Research Note)
- Ransomware Attacks in Japan H1 2026: The Gentlemen RaaS, Qilin AI-Generated Tools, and GLPI Vulnerabilities (Rescana)
- Ransomware in Japan: The Gentlemen Infrastructure and Qilin's AI Use (SOC Prime)
- Ransomware attack disrupts Japan's IDCF cloud used by govt clients (BleepingComputer)
- Japan steps up cyber warnings as data leaks hit millions of customers (The Next Web)
- Japan warns for increased vigilance against rising cyberattacks (Hurriyet Daily News)
- Japan Ransomware Activity Rises as Qilin Shows Signs of AI-Generated Tools (The420.in)
Detection coverage for TL-2026-3626
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3626 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.