Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
3 IOCs
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
Threat Actors
Malware Families
Excerpt
Compared with the same period last year, ransomware incidents in Japan increased slightly by approximately 4.7%, indicating that ransomware continues to pose a significant threat. In Japan, The Gentlemen was the most active ransomware group in the first half of 2026. Attackers continue to primarily target small- and medium-sized enterprises, with organizations capitalized at less than JPY 1 billion accounting for approximately 80% of the total — an increase of around…
Read the original report →Diamond Model
Adversary(1)
Infrastructure
Capability(9)
Victim
Indicators of Compromise
Open the mindmap →3 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| CVE | CVE-2020-1472 | Medium | Score 61/100 | First seen |
| CVE | CVE-2025-24799 | Medium | Score 51/100 | First seen |
| CVE | CVE-2025-2479 | Medium | Score 51/100 | First seen |
IOC Relationship Graph
Building graph…