MalwarePublished 19 Aug 2025

Ransomware incidents in Japan during the first half of 2025

Source AlienVault OTX General

Description

The first half of 2025 saw a 1.4-fold increase in ransomware attacks in Japan compared to the previous year, with 68 confirmed cases. Small and medium-sized enterprises remained the primary targets, with manufacturing being the most affected industry. The ransomware group Qilin emerged as the most active threat, responsible for eight incidents. A new group, Kawa4096, appeared in late June, targeting Japanese companies. The analysis also details the KaWaLocker ransomware, including its configuration, encryption methods, and the emergence of KaWaLocker 2.0 with enhanced features. The continued evolution and intensification of ransomware activities in Japan highlight the need for increased cybersecurity measures across various industries.

Impact

For European organizations, particularly SMEs in manufacturing and related sectors, this ransomware threat represents a growing risk due to the demonstrated targeting of similar business profiles in Japan. The use of advanced encryption algorithms like Salsa20 and double-extortion tactics could lead to severe operational disruptions, financial losses from ransom payments, reputational damage, and potential regulatory penalties under GDPR if personal or sensitive data is compromised. The emergence of new ransomware variants such as KaWaLocker 2.0 indicates an ongoing evolution in attack sophistication, which could bypass traditional defenses. European companies with supply chain or business relationships with Japanese firms may also face indirect impacts. Furthermore, the ransomware groups’ use of multiple TTPs suggests that attacks can be multi-faceted, involving social engineering, lateral movement, and persistence, increasing the difficulty of detection and remediation. The medium severity rating reflects the current scope limited to Japan but warns of potential spillover risks to Europe, especially if these groups expand their targeting or if similar vulnerabilities exist in European SMEs.

Defensive guidance

European organizations should implement targeted, proactive measures beyond generic advice: 1) Conduct thorough risk assessments focusing on SME manufacturing environments to identify specific vulnerabilities exploited by ransomware groups like Qilin and Kawa4096. 2) Enhance email security with advanced phishing detection and user training tailored to recognize social engineering tactics used in these campaigns. 3) Deploy endpoint detection and response (EDR) solutions capable of identifying behaviors associated with KaWaLocker, including unusual encryption activity and process injection techniques. 4) Implement network segmentation to limit lateral movement and contain infections. 5) Regularly back up critical data with immutable storage solutions and verify backup integrity to ensure recovery without ransom payment. 6) Monitor for indicators of compromise (IOCs) such as the provided file hashes and network indicators linked to these ransomware families. 7) Apply strict access controls and multi-factor authentication to reduce credential theft risks. 8) Collaborate with industry information sharing groups to stay updated on emerging threats and share intelligence. 9) Develop and rehearse incident response plans specifically addressing double-extortion ransomware scenarios to minimize downtime and data leakage. 10) Consider threat hunting exercises focused on TTPs like credential dumping, defense evasion, and persistence techniques used by these adversaries.

Indicators of compromise

Hashes 12

0bf4def902e36cc9174d89c14ec3dcac
23e6ed956e49c3cff58669bafe2499d9
64756bf452baa4da411e3a835c08d884
c3ce46d40b2893e30bf00fce72c2e1fa
689547ddd0c6be741a8dd0ec30aba9671a916418
b8c32444ceef027fb65d9cf1c823ad3c9c59acea
bd30c87774c083a1003c0b9fb0a922b702302272
c8ca0d95ff20c13e76284eec945ae6b3572a83af
33a0121068748f6e6149bc6104228a81aecdfed387d7eb7547d95481e60150b7
b60ef95da28cba0d44cad8d03121b0bec3bc3865044d010cffb8450629d91c9f

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 19 Aug 2025, 21:48 UTC

MITRE ATT&CK techniques12 from threat tags

Technical details

Indicators of compromise

Hashes 12

Community reviews

Related threats