Japan Ransomware Surge: The Gentlemen Expands & Qilin Uses AI

Executive Summary

A comprehensive threat telemetry report released by Cisco Talos reveals that ransomware incidents across Japan increased by 4.7% year-over-year in the first half of 2026, claiming at least 90 confirmed corporate victims. The Japanese manufacturing sector bore the brunt of these campaigns—representing 34% of all intrusions—followed by information communications (11%) and technical services (9%). Notably, attackers have shifted aggressively toward small- and medium-sized enterprises (SMEs), with organizations capitalized under JPY 1 billion accounting for 78% of all compromises.

The telemetry highlights the meteoric ascendancy of The Gentlemen, an emerging Ransomware-as-a-Service (RaaS) syndicate whose global leak site listings surged 2.2-fold between January and July 2026 (peaking at 108 victims in June). Forensic examination of The Gentlemen's staging servers reveals deep reliance on the open-source AdaptixC2 framework, Active Directory reconnaissance tools like RustHound, and automated cloud exfiltration pipelines. Concurrently, Qilin (the second most active ransomware cartel in Japan) has integrated generative AI / LLMs directly into its operational tradecraft, generating modular Python wipers, Veeam backup destroyers, and domain locker deployment scripts.

Technical Vulnerability Analysis & Attack Chain

Investigations into compromised Japanese networks and attacker-controlled open directory infrastructure detail a structured, multi-phase attack progression:

[Edge Perimeter Exploitation / VPN Breach]

│

├──► Unauthenticated SQLi in GLPI (CVE-2025-24799)

└──► Stolen VPN / Edge Remote Gateway Credentials

│

▼

[Phase 1: Ingress & Tunneling Platforms]

│

├──► Chisel, Ligolo-ng, Proxychains & SSH Reverse Tunnels

│

▼

[Phase 2: Internal Reconnaissance & AD Mapping]

│

├──► Masscan, Nmap, NetExec (SMB/LDAP Enumeration)

└──► RustHound (BloodHound Path Collection)

│

▼

[Phase 3 & 4: Privilege Escalation & Credential Harvesting]

│

├──► Responder (AitM NTLM Harvesting) & Impacket Relay

├──► Zerologon (CVE-2020-1472) & MS17-010 Exploitation

└──► Backup Mount (/mnt/Backup) -> secretsdump.py on ntds.dit & SAM

│

▼

[Phase 5: Cloud Exfiltration via Wasabi]

│

├──► VHDX Backups Mounted via libguestfs-tools / qemu-utils

├──► Compressed with zstd & Split into 256MiB Chunks

└──► Multi-Threaded Rclone Uploads (16 Concurrent Threads) to Wasabi

│

▼

[Phase 6: AI-Orchestrated Destruction & Ransom Deployment]

│

├──► Qilin AI Scripts: deadman.py (GPO Wiper) & veeam_kill.py (Backup Destruction)

└──► The Gentlemen AdaptixC2 ESXi / Windows Locker Deployment

1. Perimeter Infiltration & Exploitation

Attackers primarily established initial access by targeting internet-facing remote access infrastructure and exposed web applications:

• VPN & Edge Gateway Abuse: Exploitation of unpatched enterprise VPN gateways and valid compromised administrative credentials accounted for the dominant share of intrusions. 13.3% of Japanese victim incidents originated in overseas subsidiaries (led by Taiwan, the United States, and the Philippines), allowing adversaries to pivot into Japanese headquarters via trusted site-to-site tunnels.
• GLPI SQL Injection (CVE-2025-24799): Talos uncovered automated sqlmap scripts and custom exploit Proof-of-Concepts (PoCs) targeting CVE-2025-24799, a critical unauthenticated SQL injection vulnerability in GLPI asset management portals, used to extract database users and password hashes.
• cPanel/WHM Scanner: Attackers executed targeted scanners and authorization bypass test routines against exposed hosting management portals.

2. Reconnaissance, Lateral Movement, and AdaptixC2

Once inside the internal perimeter, The Gentlemen converted compromised Linux hosts into attack jump boxes:

• Tunneling: Deployed Ligolo-ng, Chisel, and Proxychains to tunnel internal traffic back to attacker servers.
• Domain Mapping: Executed RustHound (a high-performance Rust port of BloodHound) alongside NetExec to map Active Directory access graphs, enumerate domain trust relationships, and identify shortest paths to Domain Admin.
• NTLM Relay & AitM: Leveraged Responder and impacket-partial-mic to intercept LLMNR/NBT-NS broadcasts and execute NTLM relay attacks against unprotected internal servers.
• Command & Control: Standardized on AdaptixC2, a red-team post-exploitation framework supporting multi-protocol command delivery (HTTP/S, DNS/DoH, SMB) to orchestrate payloads across ESXi hypervisors and Windows endpoints.

3. VHDX Backup Dismantling & High-Speed Wasabi Exfiltration

Prior to encrypting systems, The Gentlemen executed large-scale data exfiltration with high operational discipline:

• Backup Mounting: Attackers mounted remote Windows CIFS backup shares to /mnt/Backup. Using libguestfs-tools, qemu-utils, and nbd-client, they mounted virtual hard disks (.vhdx) directly on Linux attacker instances to parse raw Windows filesystems.
• Credential Extraction: Extracted ntds.dit, SAM, and SYSTEM hives from the mounted backups, dumping hashes with Impacket's secretsdump.py into ntds.txt and SAM.txt.
• Wasabi Cloud Exfiltration: Backups and sensitive corporate IP were compressed using zstd, split into 256 MiB chunks, and uploaded to Wasabi cloud storage via Rclone utilizing 16 concurrent threads with automated retry logic to evade perimeter bandwidth alerts while optimizing throughput.

4. Qilin's AI-Generated Destructive Tooling

Forensics on staging infrastructure associated with Qilin (ranked second with 7 confirmed incidents in Japan) revealed sophisticated automation authored by generative AI:

• `deadman.py`: An automated wiper orchestrator designed to deploy destructive payloads across domain workstations via Active Directory Group Policy Objects (GPOs). The script contains structured step-by-step workflow comments (# Stage wipe payload to SYSVOL, # Create GPO via PowerShell on DC) indicative of LLM prompt-driven synthesis.
• `veeam_kill.py`: A specialized Python utility that systematically stops Veeam backup services, deletes immutable repositories, and purges Volume Shadow Copies (vssadmin delete shadows /all /quiet). The code is divided cleanly into sequential stages ("Step 1" through "Step 4") with standardized logging and exception handling.
• `deploy_locker.py`: A locker deployment harness featuring comprehensive documentation headers, prerequisite checks, and inline CLI argument parsers characteristic of modern coding assistants. Traces of a dedicated llm_chatbot environment were identified in attacker shell histories.

Threat Actor Profile & Campaign Attribution

• The Gentlemen: An emerging RaaS group active since July 2025 that has experienced exponential growth in 2026. Forensic review of .bash_history files uncovered command typos matching a Russian standard keyboard layout (црщфьш for whoami, ды for ls, шз ф for ip a, сдуфк for clear), alongside Russian-language comments in internal network keepalive scripts, pointing to Russian-speaking threat actors.
• Qilin (Agenda): A seasoned Russian-speaking RaaS outfit infamous for healthcare and critical infrastructure targeting, now pioneering the weaponization of LLM coding models to rapidly generate custom dual-extortion tooling.
• Targeting Focus: Heavy bias toward manufacturing and supply-chain hubs across the Kanto, Kansai, and Chubu industrial corridors in Japan, capitalizing on resource-constrained SME suppliers to disrupt broader conglomerates.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Patch Perimeter Web & Asset Portals:
  • Immediately update GLPI installations to remediate CVE-2025-24799 (Unauthenticated SQL Injection).
  • Verify patches for Active Directory domain controllers against CVE-2020-1472 (Zerologon) and legacy SMBv1 services (MS17-010).
• Harden Edge Remote Gateways:
  • Enforce phishing-resistant MFA (FIDO2 / WebAuthn) across all enterprise VPNs, RDP gateways, and cPanel/WHM management consoles.
  • Mandate that all overseas subsidiary site-to-site tunnels terminate in microsegmented quarantine zones requiring step-up authentication.
• Secure Backup Architectures:
  • Implement air-gapped, immutable backups with multi-person authorization (MPA) for backup deletion. Restrict CIFS/SMB access to backup shares from non-backup hosts.

2. Network & Perimeter Defenses

• Block Cloud Exfiltration Destinations: Restrict outbound Rclone and direct S3 connections from server VLANs to unauthorized object storage providers (e.g., Wasabi *.wasabisys.com, Mega, Dropbox).
• Deploy Snort Detection Rules:
  • Snort 2 SID: 1:67111
  • Snort 3 SID: 7:29
• Snort Rule for AdaptixC2 DNS/DoH Beaconing:

alert dns $HOME_NET any -> any 53 (msg:"MALWARE-CNC Suspected AdaptixC2 Encrypted Tunnel Beacon"; content:"|01 00 00 01|"; depth:4; offset:2; content:"adaptix"; nocase; classtype:trojan-activity; sid:20261017; rev:1;)

3. Endpoint Detection & Hunting Query

Sigma Rule: Veeam Backup Tampering via Python Script

title: Veeam Backup Service Termination via Suspicious Python Script

status: experimental

description: Detects command execution targeting Veeam services and shadow copies matching Qilin's veeam_kill.py pattern.

logsource:

category: process_creation

product: windows

detection:

selection_cmd:

CommandLine|contains:

- 'vssadmin delete shadows'

- 'Stop-Service -Name Veeam*'

- 'net stop "Veeam'

selection_parent:

ParentImage|endswith:

- '\python.exe'

- '\pythonw.exe'

condition: selection_cmd and selection_parent

level: critical

tags:

- attack.impact

- attack.t1490

Splunk Hunting Query: Rclone Cloud Exfiltration via Command Line

index=endpoint (EventCode=1 OR EventCode=4688)

| eval Process=lower(NewProcessName), Cmd=lower(CommandLine)

| where match(Cmd, "rclone.*copy.*wasabi") OR match(Cmd, "rclone.*sync.*--transfers.*16")

| table _time, Computer, Account, CommandLine, ParentProcessName