Loading story…
Japanese police reported 226 ransomware incidents in 2025, the second-highest annual total on record and four more than the previous year, with roughly 60% of victims identified as small and midsize businesses. The National Police Agency said prolonged disruption was associated with higher recovery costs, while major enterprises were also affected, including Asahi Group Holdings and Askul. Among the 149 cases where malware families were identified, Qilin was the most common with 32 cases, followed by LockBit with 19; 8Base appeared only once, reflecting the impact of international law-enforcement action and the availability of a recovery tool.
Regional reporting also showed Qilin active outside Japan, including attacks on a South Korean dermatology clinic and the Korean branch of a global advertising company, underscoring the group’s continued presence in East Asia. One other article in the set describes a dramatic “printer” compromise at an unnamed business, but it appears to be a standalone blog narrative about a different and unverified incident rather than the same reported ransomware trend. Overall, the relevant reporting points to sustained ransomware pressure on both SMBs and larger organizations, with Qilin remaining a prominent threat actor/toolset in the region.
TTPs, infrastructure, and targeting history in one profile.
7 events from the most recent confirmed update back to the earliest known activity.
Talos published a report on ransomware threats in Japan during 2025, identifying Qilin as the most active group in its dataset and estimating ransomware execution occurred about six days after initial compromise on average. The report also released 12 Sigma rules, YARA rules, ClamAV signatures, Snort detections, and IOCs to help defenders detect and disrupt Qilin activity before deployment.
ASEC reported that root access to a South Korean government server was being advertised for sale on BreachForums in its Week 2 March 2026 dark web monitoring summary.
ASEC reported that an elevator manufacturer in South Korea was targeted in an Everest ransomware attack highlighted in its Week 2 March 2026 roundup.
ASEC's Week 2 March 2026 report described a KillSec ransomware attack affecting a South Korean exhibition management platform.
ASEC reported that the Korean branch of a global advertising company was targeted in a Qilin ransomware incident noted in its Week 2 March 2026 report.
ASEC reported that a well-known dermatology clinic in South Korea was listed as a victim of the Qilin ransomware group in its Week 2 March 2026 roundup.
A Nippon.com report stated that 226 ransomware attacks were reported in Japan in 2025, marking the scale of ransomware activity disclosed for that year.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
blog.talosintelligence.com
Open sourcenippon.com
Open sourceasec.ahnlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware activity remained elevated across multiple regions and sectors, with recent victim claims spanning U.S. healthcare and professional services, Romanian education, Italian ICT, and U.S. technology firms. **DragonForce** claimed attacks on Deluxe Medical Supply and Syntron Bioresearch, while **Qilin** was linked to a breach at Romania’s Universitatea de Vest „Vasile Goldiș” din Arad, **nova** to Italian ICT provider SistNet, **Akira** to digital marketing firm Emerge2 Digital, and **incransom** to Health Law Advocates in Boston. Several of the incidents involved alleged data theft in addition to encryption, with actors threatening publication of stolen corporate, client, financial, and operational records. Broader reporting shows the surge is part of a sustained multinational ransomware wave. An ASEC June 2026 threat report said manufacturing was the most affected sector globally, the **United States** had the highest incident volume, and **Qilin**, **Dire Wolf**, and **World Leaks** were the most active groups by leak-site postings; it also noted **LockBit 5.0** had shifted from fixed TOR leak domains to victim-specific domains and private torrent distribution. Separate tracking of Italy found **148 confirmed ransomware claims** against organizations in the first half of 2026, with manufacturing the top target and **LockBit5** and **Qilin** the leading groups, while common intrusion paths included reused credentials, exposed RDP, and unpatched internet-facing systems.
Jul 27, 2026
A significant increase in ransomware attacks has been observed, driven by alliances between major ransomware groups and a surge in activity from the Qilin group. Qilin accounted for nearly 29% of all ransomware attacks in October 2025, with industrials, consumer discretionary, and healthcare sectors being the most targeted. North America experienced the majority of these attacks, but South Korea saw a notable spike, particularly in its financial sector, due to a sophisticated supply chain attack involving a compromised Managed Service Provider (MSP). This campaign, dubbed 'Korean Leaks,' resulted in 25 South Korean financial institutions being hit in September alone, a dramatic rise from previous months. The Qilin group operates as a Ransomware-as-a-Service (RaaS) and has demonstrated explosive growth, leveraging affiliates that include state-linked actors such as North Korea's Moonstone Sleet. The attack on South Korea's financial sector highlights the evolving tactics of ransomware groups, including the use of MSPs as initial access vectors and the blending of criminal and state-sponsored operations. The ongoing alliances and technical sophistication of these groups are expected to drive further increases in ransomware activity, especially during high-traffic periods like the end-of-year holidays.
Jun 29, 2026
Ransomware and cyber-extortion activity rose again in Q2 2026, with industry reporting showing more than 2,250 publicly named victims across roughly 90 active groups and nearly 100 countries. GuidePoint Security’s GRIT report counted 2,279 victims, up 7% from the prior quarter and 43% year over year, while ReliaQuest recorded 2,252 victims and found the United States accounted for about 49% of observed activity. **Qilin** remained a leading force in one dataset for a fifth straight quarter, while **The Gentlemen** surged into the top tier and was ranked the most active group by ReliaQuest; **DragonForce** also remained prominent despite reported declines in some rankings. Professional, scientific, and technical services stayed the most targeted sector, and researchers noted a broader shift toward **data-only extortion** and continued pressure on organizations through public leak-site exposure. Researchers also highlighted technical changes in attacker tradecraft rather than a wholesale change in ransomware operations. The quarter saw increased use of **AI and LLMs** by threat actors, including analysis of exfiltrated databases and more tailored extortion messaging, alongside continued exploitation of high-impact vulnerabilities such as `CVE-2026-50751`, `CVE-2026-48027`, `CVE-2026-46817`, and `CVE-2026-35273`. ReliaQuest identified **Deadlock** as a notable re-emerging threat after 11 months of silence, using blockchain-hosted command-and-control through a Polygon smart contract and a **BYOVD** technique to terminate EDR tools via `CVE-2024-51324`. The reports say supply-chain compromise, remote access abuse, identity attacks, lateral movement, and defense evasion remain central to ransomware operations even as payment rates decline.
Aug 11, 2026