Japan expands active cyber defense amid AI-enabled attacks

DigitalToday reported at least 81 attacks in Japan since July, and said nearly one-third of attacks over the past three years were concentrated in this period.[1] The reported targets ranged from securities firms to delivery operators.[1] On Oct. 28, the Japanese government said hackers had breached an official website for electricity and gas trading information.[1] Separately, hackers claimed they had publicly disclosed a large volume of customer information from GMO Internet Group’s foreign-exchange trading platform.[1] That disclosure is a hacker claim, rather than a government confirmation in the evidence.[1]

A PHP vulnerability disclosed the previous week prompted Mizuho Financial Group and other companies to take emergency measures.[1] JapanHacked listed 608 organizations in connection with the vulnerability, and said listed organizations paused services as a precaution.[4] None of those organizations was listed as having been hit.[4] The list included 42 of Japan’s 47 prefectures and more than 260 cities and wards.[4] For incident planning, distinguish precautions prompted by a vulnerability from confirmed compromises: the available evidence does not identify listed organizations as victims.[4]

Japan’s active cyber defense legislation took effect on Oct. 1.[3] Under the system, the government routinely monitors cyberspace and collects and analyzes communications data for signs of potential attacks.[3] Police and the Self-Defense Forces can access computers used to launch attacks and take steps to prevent further breaches.[3] Neutralization measures can include accessing an attack-source computer to delete malware, changing IDs or passwords, or shutting the computer down.[3] Overseas operations require prior consultation with the foreign minister, and administrators are generally notified after a neutralization operation.[3]

Experts said AI agents and open-source hacking tools were helping criminal groups overcome Japan’s ageing infrastructure and language barriers.[1] Russian-speaking groups such as LockBit and Qilin are believed to be behind many attacks, while some groups were suspected of working with North Korean hackers.[1] DigitalToday also said the Chinese-developed defense-checking AI tool Artex had been linked to multiple attacks.[1] Takaichi said the government would compile an emergency countermeasures package as early as the following week.[3] She also directed officials to strengthen private-sector cooperation and develop a framework for using industry expertise from initial response through recovery.[2]