An overview of ransomware threats in Japan in 2025 and early detection insights from Qilin cases

There were 134 ransomware incidents reported in Japan in 2025, representing a 17.5% year-over-year increase from 2024.

In 2025, a total of 134 ransomware incidents were reported in Japan, marking a 17. 5% increase compared to 2024. Among these, 22 incidents were attributed to Qilin, representing 16. 4% of the total. In 2025, Qilin ransomware was highly active. Looking ahead to 2026, unless there is significant external pressure or disruption, it is likely to further increase its impact. While there are some variations in tactics across affiliates, operations are expected to become more automated, with fewer trial-and-error steps and increasingly refined tradecraft.

Evidence suggests that some Qilin affiliates may have ties to countries in the post-Soviet region, including the Baltic states. Rather than focusing on post-ransomware execution, this blog examines detection opportunities during the pre-ransomware phase.