In the first half of 2026, ransomware incidents in Japan rose slightly by 4.7%, with 90 reported cases. The Gentlemen ransomware group was the most active, responsible for 14 incidents, followed by Qilin and SafePay with seven incidents each. The Gentlemen employs a Ransomware-as-a-Service model and a double-extortion tactic, encrypting data and threatening to leak stolen information. Their leak site listings more than doubled from January to July 2026. The group targets mainly small- and medium-sized enterprises, particularly in manufacturing, professional services, and wholesale trade. Investigations uncovered The Gentlemen’s infrastructure, including tools for network tunneling, Active Directory reconnaissance, and exploitation of CVE-2025-2479, a SQL injection vulnerability. Qilin is notable for using AI to improve attack efficiency. The ransomware threat landscape in Japan is dynamic, with rapid changes in active groups and tactics.

The ransomware activity continues to pose a significant threat to Japanese organizations, especially small- and medium-sized enterprises with capital under JPY 1 billion, which constitute the majority of victims. The manufacturing sector is the most affected industry. The Gentlemen’s use of double-extortion increases the risk of data leakage in addition to encryption. The rise in leak site listings indicates increased operational tempo and potential data exposure. The involvement of advanced tools and exploitation of known vulnerabilities like CVE-2025-2479 suggests sophisticated attack capabilities. Qilin’s use of AI may further enhance attack efficiency and effectiveness. The persistence and growth of these ransomware groups indicate ongoing risk to affected organizations.

No specific patch or remediation is indicated for this threat report as it describes ransomware activity rather than a software vulnerability. Organizations should focus on ransomware defense best practices relevant to the described tactics, such as securing Active Directory, monitoring for exploitation of known vulnerabilities like CVE-2025-2479, and defending against network tunneling and credential relay attacks. Increased vigilance is advised against emerging groups like The Gentlemen and Qilin. Since this is a threat landscape report without direct vendor advisories or patches, check vendor advisories for updates on CVE-2025-2479 and related vulnerabilities. Incident response plans should consider the double-extortion tactics described.