Ransomware Incidents in Japan Rise to Approximately 1.6 Times the 2025 Half-Year Average as S2W Releases Threat Trends for the First Half of 2026

On 14 October, S2W published the Japanese version of a report summarising the ransomware trends and state-sponsored APT threat landscape in the first half of 2026. The report is based on observations of leak sites and cybercrime forums on the dark web, as well as analysis of activities by state-sponsored APT groups.

Japan recorded 64 ransomware incidents, while the global total was 5,984. The total increased by 35.1% from 4,429 in the first half of 2025, with Japan recording the highest number among the 3 East Asian countries. By month, February recorded the highest number, at 19 incidents.

By group, incidents in Japan linked to The Gentlemen changed from 1 to 13 around the middle of 2025, making it the group that disclosed the highest number of incidents in Japan in the first half of 2026. Forums associated with ransomware-as-a-service have continued to disperse across and grow more active on multiple alternative forums even after their closure.

The number of reported state-sponsored APT incidents increased by 7.5% to 158, comprising 99 linked to North Korea, 33 to China and 26 to Russia. North Korea continued attacks targeting developers and their environments through fake recruitment activities, impersonation and the use of generative AI. China expanded its attacks on military and energy organisations, mainly in the telecommunications sector, with reports also covering BPFDoor incidents and activity targeting military-related entities in Japan, South Korea and Taiwan. In addition to intelligence gathering, Russia was confirmed to have conducted attacks aimed at destruction, including an incident targeting Poland's power grid.

As a security concern, 38 cases of prompt injection embedded inside malware were also confirmed, as a means of obstructing analysis by security agents using LLMs.