Qilin and Japan: Attackers Probing Japanese Networks

Japan is in an unusually intense run of cyber incidents, and Qilin is the ransomware group to watch.

This report combines network analysis in KELA CONTROL with KELA’s monitoring of leak sites and cybercrime forums. It shows a Qilin affiliate server scanning Japanese VPN portals, sets out how Qilin became the most frequent ransomware claimant against Japan in KELA’s data, maps the affiliates and brokers behind it, and closes with recommendations and indicators of compromise.

Key findings:

• VPN portals targeted: A Qilin affiliate server scanned 12 Japanese Palo Alto GlobalProtect VPN portals within one hour on August 8. A scan shows a portal was targeted, not breached.
• Published indicators go stale: After JPCERT/CC published attacker IP addresses on October 8, a data-theft operator (not Qilin) moved to new infrastructure that KELA mapped in CONTROL.
• About 400 organizations probed: That operator probed 679 Japanese hosts at about 400 organizations. dip Inc. (Baitoru) is the only confirmed victim.
• Most frequent claimant: Qilin claimed 30 of the 368 Japanese ransomware victims in KELA’s data between January 2023 and October 2026, more than any other brand.
• Pace has picked up: September 2026 was Qilin’s highest month against Japan, and KELA assesses that the May arrest of an alleged core member has not slowed it.
• Edge devices first: KELA assesses that VPN edge devices and purchased credentials are the main ways Qilin affiliates enter Japanese networks.