Threat Intel
Japan’s Ransomware Surge: The Gentlemen’s Rampage and Qilin’s AI‑Powered Attacks in H1 2026
In the first half of 2026, Japan saw a 4.7% rise in ransomware incidents, totaling 90 attacks and an average of 13 per month. The Gentlemen led the charge, doubling its leak‑site activity, while Qilin leveraged AI to streamline operations. Small‑ and medium‑sized firms under ¥1 billion capital suffered 80% of the attacks, with manufacturing firms hit hardest at 34%. Emerging groups such as SafePay also increased activity, signaling a rapidly shifting threat landscape.
Japan’s ransomware landscape continues to tighten its grip on the economy. Over the first seven months of 2026, 90 separate incidents were logged—just a 4.7% uptick from the same period last year—yet the damage is far from contained.
Incident Overview
- Average of 13 attacks per month, peaking at 19 in April.
- 90 organizations affected, with 13.3% involving overseas offices (Taiwan, the U.S., and the Philippines leading).
- Manufacturing sector accounts for 34% of all incidents, followed by information & communications (11%) and services (9%).
Key Players
- The Gentlemen – 14 incidents, leak‑site listings surged from 48 to 105, a 2.2× increase. Possible Russian‑speaking operatives identified.
- Qilin – 2nd most active, noted for employing AI to automate victim identification and payload delivery.
- SafePay – 7 incidents, showing a rise in activity and marking it as an emerging threat.
- Other groups spotted: NightSpire, NetRunner, LockBit 5.0, RansomEXX, Stormous, AiLock.
Industry & Size Impact
- SMEs with <¥1 billion capital represent 78% of victims, up 13% from 69% in 2025.
- Within that slice, firms under ¥100 million capital account for 48% of attacks.
- Manufacturing firms are the most vulnerable, followed by IT and services.
Emerging Trends & AI
- Qilin’s use of AI signals a shift toward more efficient, automated ransomware campaigns.
- The Gentlemen’s rapid growth in leak‑site activity suggests a focus on data exfiltration and monetization.
- SafePay’s uptick indicates that previously lower‑profile groups are stepping up their game.
What This Means for Japanese Businesses
- SMEs must prioritize patching, employee training, and robust backup strategies.
- Manufacturing and IT sectors should enforce strict network segmentation and monitor for unusual data flows.
- Stay alert to new ransomware families and AI‑driven tactics that can accelerate breach timelines.
“The landscape is evolving fast. Those who assume they’re safe because they’re small are the next target.” – Talos Research Team
Related articles
CISA, FBI Warn of Gunra Ransomware Surge Targeting Critical Infrastructure
CISA and the FBI alert that the Gunra ransomware gang is ramping up attacks across healthcare, energy, manufacturing, transportation, finance, and federal agencies. Using spear‑phishing, compromised vendor portals, and vulnerable remote‑desktop protocols, Gunra encrypts data and exfiltrates it before demanding ransom. The agencies urge immediate patching, MFA, offline backups, and incident reporting to mitigate the threat.
Read briefing
Ransomware Landscape Shifts: Q2 2026 Report Highlights Growing Competition and AI‑Accelerated Ops
Check Point Research’s Q2 2026 ransomware report shows the ecosystem is still dominated by a handful of RaaS groups, but the tail is widening: 93 active actors now versus 71 in Q1, with the top 10 accounting for 57.6 % of victims (down from 71 %). Victim numbers stayed flat quarter‑on‑quarter, yet the US share dropped to 42 % as new groups like The Gentlemen and Krybit target fewer American targets. The Gentlemen’s internal leak revealed an AI‑powered ransomware‑management panel built in three days, marking the first hard evidence that generative‑AI is speeding up malicious tool development. P
Read briefing
JadePuffer AI‑Driven Attacks Target Azure Tenants, Destroy Storage and Key Vaults
The JadePuffer ransomware operator has been using AI agents to automate attacks against Azure tenants, mapping resources, stealing credentials, and deleting critical storage and key vaults. Over 100 storage accounts were wiped in a seven‑minute window, though some survived due to resource locks. Defenders should enable resource locks, audit service principals, and monitor for anomalous API activity.
Read briefing
Bomgar RMM Compromise Surge: Immediate Defensive Actions
Huntress SOC reports a spike in attacks targeting Bomgar RMM instances. Defenders should verify patch status, enforce MFA, isolate compromised endpoints, and monitor for lateral movement. Immediate remediation can limit attacker persistence.
Read briefing