Japan

This page covers cyber threats to Japan. It brings together official Japanese texts (the National Police Agency NPA, the National Cybersecurity Office NCO and its predecessor NISC, the Financial Services Agency FSA with the Kanto Local Finance Bureau, JPCERT/CC and the Personal Information Protection Commission), a joint US and Japanese advisory, MITRE ATT&CK and Brandefense research. Where an official source names Japan as a target, the page says who said it and when.

Threat groups that official sources link to Japan

Each group with a link below has a profile in our threat group library. Attribution is stated as given by the named body.

Lazarus Group: the NPA, the FBI and the US Department of Defense Cyber Crime Center said on 24 December 2024 that North Korean actors called TraderTraitor stole about 48.2 billion yen of crypto assets from the Japanese firm DMM Bitcoin in May 2024. The NPA says TraderTraitor is considered part of the Lazarus Group. It also notes that the FSA, NPA and NISC had issued an alert on Lazarus on 14 October 2022.

menuPass (APT10): MITRE ATT&CK (group G0045, read October 2026) says menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy and government sectors globally, with an emphasis on Japanese organizations.

BlackTech (no profile yet): on 27 September 2023 the US NSA, FBI and CISA, together with Japan’s NPA and NISC, published advisory AA23-270A on the China-linked BlackTech actors. It says they target international subsidiaries of US and Japanese companies and have targeted government, industrial, technology, media, electronics and telecommunication sectors.

MirrorFace (no profile yet): on 8 January 2025 the NPA and NISC assessed that campaigns against organizations, businesses and individuals in Japan since about 2019 were run by MirrorFace, with suspected Chinese involvement, mainly to steal information on national security and advanced technology.

Incidents on record

The incidents listed below are the major ones that Japanese authorities or their partners reported, with national impact. Where sources differ, the incident page says so. Small incidents are not listed.

What the NPA reports

The NPA report on threats in cyberspace in 2025 (published March 2026) says 226 ransomware attacks were reported in 2025, a high level. By industry, manufacturing accounts for about 40 percent of the damage, and small and medium-sized entities for about 60 percent of victims. In a survey of victims, VPN devices accounted for more than 60 percent of intrusion routes. It reports that in September 2025 a major beverage company reported a ransomware attack on its servers. For state-linked activity, the NPA says suspected APT groups mainly target information and communications, advanced technology and manufacturing, and academic research, and that such attacks are expected to continue beyond 2026. In November 2025 police arrested a Chinese national and others for unauthorized access to securities accounts and fraudulent trading. With Europol and the FBI, the NPA also ran joint investigations of the Phobos and 8Base ransomware groups.

How attackers target Japan: Brandefense research

State-linked espionage. Our Tick profile says MITRE ATT&CK describes Tick as active since at least 2008, mainly against Japanese government, biotechnology, electronics manufacturing and industrial chemistry organizations. The BlackTech post says US and Japanese government agencies link it to China and that it mainly targets government, military and telecommunications organizations through routers and other network devices. The Lazarus Group post says South Korea and Japan appear to be under the most pressure from the group. The Liminal Panda profile lists a 2022 campaign against technology and manufacturing businesses in Taiwan and Japan, and the DarkHotel profile lists 2017 attacks on Japanese and South Korean defense contractors. The Konni profile and the RokRAT summary name Japan among its targets, and the Mythic Leopard and Ocean Lotus posts list Japan among targeted countries.

Banking and fraud. Our post on the OCTO banking trojan lists Japan among the countries whose financial institutions it targets.

Ransomware. Our post on significant data breaches says a Japanese media firm and its video platform had a data breach made public in June 2024 after the BlackSuit ransomware group compromised their systems the month before, exposing 250,000 user records and internal documents. The Hitachi Energy post reports that the Cl0p group targeted the energy unit of the Japanese Hitachi group through the GoAnywhere flaw. The Q2 2026 ransomware groups post says a FortiGate exploitation pattern seen in Nightspire intrusions is associated with targeting Japan and Turkey in Q1 2026 data.

How Brandefense helps

In plain words, Cyber Threat Intelligence is how a security team in Japan learns which groups and malware are aimed at its country and sector. Dark Web Monitoring is how it learns that staff or customer logins and payment cards are for sale, and Phishing Monitoring is how it finds fake sites that copy its brand.

Law and national strategy

The Basic Act on Cybersecurity has been in effect since 2015. After the Cybersecurity Capability Enhancement Act and related laws of May 2025, the NISC was reorganized and the National Cybersecurity Office (NCO) was set up in July 2025. The Cybersecurity Strategy of December 2025 sets objectives with the next five years in mind and plans remote access and neutralization measures carried out jointly by the police and the Ministry of Defense and Self-Defense Forces. The Common Cybersecurity Standards for Critical Infrastructure entered into force on 1 October 2026.

How incident response is organized

The NCO acts as a governmental CERT, and with JPCERT/CC, which covers private entities, it works as a national CERT. A real-time monitoring team called GSOC watches government networks. JPCERT/CC is the first CSIRT set up in Japan and acts as a CSIRT of CSIRTs. The NPA investigates and issues alerts, often together with NISC, and the FSA and the Kanto Local Finance Bureau supervise crypto-asset exchanges, as in the DMM Bitcoin case of 2024.

Personal data

The Personal Information Protection Commission publishes the Act on the Protection of Personal Information; its consolidated text is dated 1 April 2023.

The official Japanese sources opened give one national attack count, 226 ransomware reports for 2025. Further figures for Japan will come from Brandefense Atlas.