# Japan Cyber Emergency: Nationwide Ransomware and Data Theft Incidents, Qilin Operation Using Possibly AI-Generated Python Scripts

> Ransomware, unauthorized access and data theft hit organizations across Japan in 2026, and officials described a 'state of emergency in cyber space'. Cisco Talos assessed with medium-to-high confidence that Python tools recovered from a Qilin-linked open directory (deadman.py, veeam_kill.py, deploy_locker.py) were written with LLM assistance.

- **Published:** 2026-10-15T14:25:34Z
- **Last reviewed:** 2026-10-15T14:25:34Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3626
- **ID:** TL-2026-3626
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Qilin
- **Detections:** 9 · **IOCs:** 16 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-24799

## Description

Japan saw a sharp rise in ransomware, unauthorized access and data-theft incidents through 2026. Cisco Talos counted 90 ransomware incidents against Japanese organizations from January to July 2026, 4.7 percent above the 86 recorded in the same period of 2025. Organizations with capital under JPY 1 billion made up 78 percent of victims (69 percent a year earlier), and manufacturing was the most affected sector at 34 percent. The National Police Agency recorded 123 ransomware incidents in the first half of 2026. In Talos data The Gentlemen RaaS led Japan-specific activity with 14 incidents, followed by Qilin and SafePay with seven each.

In October 2026 the incidents turned into a government-level response. On October 7 a ransomware attack on IDC Frontier's IDCF Cloud (a SoftBank Group subsidiary) disrupted East Japan Region 1 and affected 495 companies and local governments, including government clients. BleepingComputer reported 225 encrypted databases (3.6 PB), 239 compromised hypervisors, about 16,000 sealed VM disks and 554,153 wiped snapshots. The article did not name the ransomware group. Separately, more than 20 prominent firms disclosed breaches. The Times Car breach exposed about 6.6 million member accounts, JR East exposed about 1.67 million customer email addresses, and Lawson, Daiwa Securities and Bookoff also reported leaks. Japan's government issued a warning on October 9, and Masaaki Taira, head of the National Cybersecurity Strategy Headquarters, called the situation 'a state of emergency in cyber space'. The National Cybersecurity Office told ministries, local authorities and companies to update security protection, use strong passwords and tighten supply-chain security. Per Aqua, IPA issued a security alert on October 9, NICT published a statement on October 13 on AI making application analysis and vulnerability discovery more efficient for attackers, and the National Cybersecurity Office issued guidance on October 14. The 'access neutralization' powers under Japan's active cyber defence law took effect on October 1. The sources do not conclusively attribute the October incidents (including IDCF) to Qilin, to AI-enabled tooling or to a single actor.

The AI finding comes from Cisco Talos's report on its investigation of The Gentlemen's infrastructure and evidence of Qilin's AI use. Talos recovered Python scripts from a Qilin-linked open directory. deadman.py deploys destructive actions to multiple machines in a Windows/Active Directory environment at a specified time and centrally manages their status. Its Group Policy function carries workflow comments such as 'Stage wipe payload to SYSVOL', 'Stage startup script' and 'Create GPO via PowerShell on DC'. veeam_kill.py is designed to stop, disable and destroy Veeam backups. deploy_locker.py distributes and executes the ransomware across multiple endpoints and contains documentation-style text on purpose, prerequisites and usage. Talos's basis for the LLM assessment was step-labelled structure (Step 1 to Step 4), documentation-like comments, redundant progress logging, and a .bash_history showing commands that inspected an 'llm_chatbot' directory. The same history contained Russian keyboard-layout artifacts, which Talos took to suggest a Russian-speaking operator. The findings show AI being used to speed up tool development, not to introduce new techniques, so defenders should rely on behavioral detection (unauthorized GPO changes, backup-service termination, bulk AD enumeration, SYSVOL staging) over signatures.

Alongside Qilin, Talos documented The Gentlemen's chain: tunnelling with Chisel and Ligolo-ng, scanning with Masscan and Nmap, AD collection with RustHound, BloodHound and NetExec, credential capture with Responder and impacket-partial-mic, exploitation of the GLPI SQL injection CVE-2025-24799, credential extraction (ntds.dit, SAM, SYSTEM), and rclone exfiltration to Wasabi in 256 MiB chunks. CSA reports that VPN flaws or misconfigurations, stolen credentials and exposed edge devices are the main initial access routes in Japan. The Aqua source names exposed applications, unpatched systems, supply-chain dependencies and insufficient response readiness as the weaknesses involved. No CVE, IP, domain or file hash IOC is published in any reviewed source, so the IOC set below is behavioral and tooling-based.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1587.001 Develop Capabilities: Malware
- T1588.007 Obtain Capabilities: Artificial Intelligence
- T1059.006 Command and Scripting Interpreter: Python
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
- T1685 Disable or Modify Tools
- T1003.003 OS Credential Dumping: NTDS
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1087.002 Account Discovery: Domain Account
- T1046 Network Service Discovery
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1572 Protocol Tunneling
- T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage
- T1490 Inhibit System Recovery
- T1485 Data Destruction

## Sources

- [Japan's Cyber Emergency Is a Warning for the World (Aqua Security)](https://www.aquasec.com/blog/japans-cyber-emergency-is-a-warning-for-the-world/)
- [Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen's infrastructure and evidence of Qilin's AI use (Cisco Talos)](https://blog.talosintelligence.com/ransomware-incidents-in-japan-in-the-first-half-of-2026/)
- [Japan's H1 2026 Ransomware Surge Hits SMEs, Qilin Uses AI Scripts (CSA Research Note)](https://labs.cloudsecurityalliance.org/research/csa-research-note-japan-ransomware-qilin-ai-20260918-csa-sty/)
- [Ransomware Attacks in Japan H1 2026: The Gentlemen RaaS, Qilin AI-Generated Tools, and GLPI Vulnerabilities (Rescana)](https://www.rescana.com/post/ransomware-attacks-in-japan-h1-2026-analysis-of-the-gentlemen-raas-qilin-ai-generated-tools-and-glpi-vulnerabilities)
- [Ransomware in Japan: The Gentlemen Infrastructure and Qilin's AI Use (SOC Prime)](https://socprime.com/active-threats/ransomware-in-japan-the-gentlemen-infrastructure-and-qilins-ai-use/)
- [Ransomware attack disrupts Japan's IDCF cloud used by govt clients (BleepingComputer)](https://www.bleepingcomputer.com/news/security/ransomware-attack-disrupts-japans-idcf-cloud-used-by-govt-clients/)
- [Japan steps up cyber warnings as data leaks hit millions of customers (The Next Web)](https://thenextweb.com/news/japan-cyberattacks-warning-data-leaks)
- [Japan warns for increased vigilance against rising cyberattacks (Hurriyet Daily News)](https://www.hurriyetdailynews.com/japan-warns-for-increased-vigilance-against-rising-cyberattacks-227915)
- [Japan Ransomware Activity Rises as Qilin Shows Signs of AI-Generated Tools (The420.in)](https://the420.in/japan-ransomware-ai-qilin-gentlemen-cisco-talos-report/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3626