Japan Cyber Threat Landscape Report, October 2026

The servers went dark first.

On October 7, 2026, systems belonging to 495 companies and local governments stopped answering at once. Nobody had broken into 495 networks overnight. Someone had broken into the one cloud they shared. IDC Frontier, a SoftBank group provider, confirmed ransomware in its East Japan Region 1 and shut the management consoles in its other regions before the damage could spread.

Then came the message. The intruder left it on the console, and it read like a receipt. Seven minutes, it claimed, had been enough to get in. From there it said it reached 239 hypervisors, sealed 16,000 virtual machine disks, and erased 554,153 snapshots. Every figure is the attacker's own boast and none has been verified. The snapshots were the line meant to frighten, because they were the copies customers believed would bring them back.

The next day the provider answered the question every customer was asking. Data in four affected zones would be difficult to retrieve or restore, and customers should rebuild from their own backups. Many of them had handed their systems to a provider precisely so someone else would hold the way back. Now the way back was theirs again, and the attacker had already walked through it.

That is where the suspense ends and the pattern begins, because nothing about this was new. It was the shape of Japan's entire threat landscape drawn in a single week.

Introduction

Japan's adversaries no longer need to breach the country's largest enterprises to halt them. They breach the platforms those enterprises share, and the outage travels downstream on its own. A ransomware attack on a parts supplier stopped all fourteen of Toyota's domestic plants in 2022. One terminal system halted the Port of Nagoya, the country's largest by cargo volume, in 2023. In the past year the attackers moved further down the stack, into the data centers and cloud regions sitting beneath whole sectors at once.

Underneath the concentration sits a quieter problem, and it is the one that should worry a Japanese board most. Japan has outsourced not only its systems but much of its ability to watch them. Vendors hold the logs, the administrators, and the recovery copies. In the incidents defining the past decade, the victims learned what had happened from a third-party. Allies found the 2020 compromise of Japanese defense networks. Police told JAXA of its 2023 breach. IDC Frontier's customers learned from a message left on a screen they did not control.

Nation State Collection

The strategic weather turned at the same time. Sanae Takaichi became prime minister in October 2025, and in November she told the Diet that a Chinese attack on Taiwan could meet the legal threshold for Japan to exercise collective self-defense. Beijing demanded a retraction and turned up the pressure across trade, travel, and culture. For Chinese intelligence services the dispute did something simple and consequential. It raised the value of a specific set of Japanese secrets. Ones describing how far Tokyo's Taiwan planning extends and how US forces in Japan would move in a contingency. Japan named China, Russia, and North Korea as state-level cyber threats in its December 2025 strategy, unusually direct language for a Japanese government document.

Those requirements map onto the targets China has already pursued. On January 8, 2025, the NPA attributed a campaign running since around 2019 to MirrorFace and assessed a suspected link to the Chinese state. The targets were the defense and foreign ministries, think tanks, politicians, and journalists, and the tradecraft was patient rather than loud. MirrorFace lived inside Active Directory for months, abused trusted Microsoft features such as Visual Studio Code tunnels and Windows Sandbox, and routed command and control traffic through infrastructure most defenders allow or fail to adequately screen. Found years after the fact, it is the template for how a capable threat actor behaves inside a Japanese network.

China rarely enters networks through the front door. A September 2023 joint advisory described CIRCUIT PANDA (aka BlackTech) modifying router firmware at the overseas subsidiaries of Japanese companies, then pivoting through the trusted connection into the headquarters in Japan. The parent trusts the subsidiary, the subsidiary is less defended, and the corridor between them operates more or less unwatched.

Chinese operators have also turned Japanese homes into infrastructure. A China-nexus relay network built from more than 1,000 compromised home and office routers used 107 infected devices sitting on Japanese IP addresses, which lets espionage traffic against Japan and its neighbors look like ordinary Japanese browsing.

The worst version of this is not collection. It is pre-positioning. The model is VANGUARD PANDA (aka Volt Typhoon), which US agencies documented holding quiet access inside US critical infrastructure for disruption rather than intelligence. No public evidence yet shows the equivalent inside Japan. That absence is an intelligence gap, not a clean bill of health, and it is the single question that matters most if a Taiwan crisis ever arrives.

Technology is the other Chinese objective, and it does not always travel over the network. Japan has bet heavily on leading-edge chipmaking, injecting a further ¥150 billion into Rapidus to reach 2-nanometer production by 2027. This creates a concentrated and durable collection target. The channels are not only intrusions.

A senior researcher at a national institute was arrested in 2023 for emailing fluorine compound data to a Chinese company, and a Tokyo Electron employee in Taiwan was later sentenced for obtaining TSMC process secrets. Japanese firms can become conduits for leakage, not only victims of it, and the exposure falls on Japan either way. Rightfully so.

North Korea runs a different operation with a clearer motive, which is money. The defining case is the May 2024 theft of about US$308 million, or ¥48.2 billion, from the exchange DMM Bitcoin. The NPA, FBI, and US Department of Defense attributed it to PRESSURE CHOLLIMA (aka TraderTraitor). PRESSURE CHOLLIMA is a North Korean-nexus adversary allegedly split-off from the broader LABYRINTH CHOLLIMA lineage around 2019.

The entry point was not the exchange. It was an employee at one of its software suppliers, approached by a fake recruiter with a malicious coding test, whose stolen session let the operator alter a legitimate transaction request from inside a trusted workflow. By the first half of 2026, one estimate put North Korea at about 55 percent of all cryptocurrency stolen worldwide. For Pyongyang this is weapons financing, which places it inside Japan's national security problem rather than its fraud statistics.

eCrime Scales Through Trust

Ordinary eCrime has learned the same lesson about trust. Most ransomware hitting Japan comes from ransomware-as-a-service, where a core group rents the tools and independent affiliates perpetrate the actual attack. The brand on the ransom note matters less than the affiliate behind it.

When the most prolific program of 2024 collapsed in April 2025, its affiliates migrated, and Qilin became the most common variant according to Japanese police data. Of 149 NPA cases with an identified variant in 2025, Qilin accounted for 32, with LockBit, run by BITWISE SPIDER, and Akira, run by PUNK SPIDER, close behind.

Forescout ranked Japan the 14th most claimed victim country on ransomware dedicated leak sites in early 2026, up from 28th two years earlier. The affiliates arrive the same way nation state operators do, through VPN and edge appliances the customer assumes someone else maintains, and through harvested credentials purchased from brokers who specialize in nothing but access. In most cases, the valid credentials are purchased from various forums and market places on the criminal underground, aka the dark web.

The affiliates aim where it hurts, and in Japan that increasingly means the recovery path. Ransom pressure works best against a victim who does not hold its own recovery, which is exactly what the IDC Frontier customers discovered. The basic playbook has not changed in years. The aim has moved from the enterprise to the platform sitting beneath it.

The larger financial damage needs no malware at all. Attackers holding stolen credentials can move money and trade securities without breaking into anything. Special fraud recorded by the NPA, including social media investment and romance scams, reached a provisional ¥181.6 billion in the first half of 2026. A wave of hijacked brokerage accounts in 2025 produced ¥571 billion in unauthorized trades, with operators buying and selling inside accounts they never needed to drain.

The wall that used to protect Japanese targets, a barrier of fluent Japanese most foreign operators could not scale, is gone. Google's Threat Intelligence Group calls the collapse of that language barrier a major threat to Japan, because any operator with a generative AI tool now writes a culturally fluent lure at scale.

Hacktivism Answers Policy

Politics brings the noisier attacks. NoName057(16) and allied pro-Russian groups have answered Japanese policy decisions with denial-of-service attacks since 2024, and US prosecutors in December 2025 alleged the Russian government financially backs the group. Their claims increasingly feature exposed industrial and IoT interfaces, and Japan has roughly 22 million discoverable devices facing the internet.

The Keen Sword 27 military exercise, scheduled for October 19 to 29, is a likely trigger for the next round. The disruption is usually brief and the physical effect usually limited, but the targets are drifting from websites toward the controllers behind them, which is a different kind of risk.

Authority Without Sight

Japan's own telemetry points the same way as the foreign vendor data. NICT's darknet sensors observed about 701 billion packets in 2025, roughly ten times the per-address level of a decade earlier, most of it scanning aimed at exposed devices. JPCERT/CC's coordination center found that phishing made up about 89 percent of the incidents it handled in one quarter of 2026, and seven in ten of those sites impersonated Japanese brands, mostly financial. IPA's annual ranking of the top threats put ransomware first for the eleventh year running and attacks on supply chains and outsourcing partners second. Japanese practitioners already rank the outsourcing problem above targeted attacks and vulnerability exploitation.

All of this lands on a country that just handed itself more power over cyberspace than at any point in its history. On October 1, 2026, Active Cyber Defense went live, and police and the Self-Defense Forces gained authority to reach into attacker infrastructure and neutralize it. The powers were in force when the IDC Frontier consoles went dark. No group had claimed the attack, no target had been named, and the state cannot act against what nobody has found.

That is the paradox at the center of Japan's position. IPA's own comparison placed 73.6 percent of Japanese IT professionals inside IT companies rather than the organizations they defend, against about 35 percent in the United States. The sight needed to find an intrusion, investigate it, and recover from it now sits mostly with vendors.

One ransomware victim in 2026 could not finish its own forensic investigation, because its hosting provider refused to cooperate under the contract. Japan has built a state able to strike and a society unable to see. Recorded Future assesses adversaries will simply route around the reporting perimeter, through foreign subsidiaries, non-designated suppliers, and short-lived hosting. The communications analysis best suited to catching quiet collection does not have to commence until late 2027.

Japan is not alone in this, which is the uncomfortable regional footnote. South Korea lost 647 government systems to a data center fire in 2025, including a file store that had never been backed up externally. Indonesia watched ransomware paralyze its national data center in 2024, where about 98 percent of the affected data had no backup at all.

Concentration failure is an Asia-Pacific condition, not a Japanese quirk, and Japan sits in the middle of the pack rather than the bottom. Its attribution record and its police capability are genuinely strong. Its ability to see into its own networks is the weak link.

Conclusion

The most likely course of action over the next twelve months is not a catastrophe. It is friction, the chronic drain of espionage, ransomware, fraud, and episodic hacktivism against a concentrated and poorly observed set of targets. Earnings will slip, platforms will wobble, and public confidence in domestic providers will erode a little further with each outage. That is the baseline, and it is expensive enough on its own.

The most dangerous course of action is the one Japan cannot yet see. In a Taiwan crisis, China would not need seven minutes inside every Japanese ministry, port, and power company. It would need seven minutes inside the few platforms they all share, with the effects dressed up as ransomware or hacktivism so the response stalls on questions of attribution while the clock runs. That scenario carries low likelihood within a year and severe impact if it ever comes. Japan's own incident record already shows how a single platform failure cascades into national paralysis.

Japan has spent a generation handing its systems to others. Without ever consciously deciding to, it handed over the ability to see them, investigate them, and bring them back. In peacetime that bargain costs revenue and patience.

In a crisis it would cost time, which is the one thing an adversary most wants to take. And Japan would learn what had happened the way IDC Frontier's customers did, from a message left on someone else's screen.

Praeryx produces bespoke cyber threat intelligence like the analysis above, built for a single organization, sector, region, or even an entire country. If your board or security team needs this better comprehend your own exposure, reach out and let us explore how we may assist.