Threat Intelligence Analyst: 2026-09-19

1. Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen's infrastructure and evidence of Qilin's AI use

   Cisco Talos, 2026-09-17. Read, 17 min.

   Talos counted 90 ransomware incidents in Japan in the first half of 2026, up 4.7% year over year, with manufacturing at 34% of victims and organizations capitalized under one billion yen accounting for 78%. The Gentlemen was the most active group with 14 incidents, and Talos reconstructed its six-phase intrusion chain, from Chisel and Ligolo tunneling and masscan and BloodHound enumeration through Zerologon credential theft to secretsdump against backups and Rclone exfiltration. In Qilin operator scripts, Talos found documentation-style comments and step-by-step workflow structure it assesses with medium to high confidence were LLM-generated.

   Why it matters for this role: Turn The Gentlemen's named tooling, Chisel, Ligolo, masscan, BloodHound, Zerologon, secretsdump and Rclone, into hunting requests for the detection team, and flag the manufacturing and smaller-company victim skew if your organization or clients fit that profile. Pass the Qilin LLM finding along with its medium to high confidence hedge intact rather than as a fact.

Threat Intelligence Analyst