Attack techniques, threat actors and technical advisories affecting Japan, with indicators and practical checks for defenders.
ThreatsUpdated
A week after the critical PHP flaws were fixed, CISA confirms exploitation, Palo Alto Networks reports attacks on firewall management interfaces running PHP inside, and a public contest was won within hours. Attack surface management tools could not tell operators where PHP was running. What it came down to was asset management, including SBOMs.
ThreatsUpdated
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that allow unauthenticated remote code execution. Before the release, Japanese services from pixiv to childcare app Codmon switched off, and Prime Minister Takaichi called pausing websites an effective way to cut risk.
ThreatsUpdated
GMO Cybersecurity by Ierae says attackers behind Japan's breach wave used ARTEX, an open-source AI penetration testing tool from China, against about 20 Japanese companies, eight of which have already disclosed breaches. CrowdStrike saw the same tool in attacks on South Korean banks.
ThreatsUpdated
JPCERT/CC examined servers used in Japan's string of data breaches and found AI-assisted scanning and API attacks, Android and Flutter app reverse engineering, SSRF testing, and targets outside Japan.
ThreatsUpdated
Japan's NICT says attackers are analyzing public Android apps to map and attack their backend APIs, one cause of Japan's breach wave. The four flaws targeted, and what to check.
ThreatsUpdated
Japan's national CERT describes the attacks behind the breach wave: known-flaw scanning, internal API abuse, a Metabase bug, web shells and AI penetration testing tools such as ARTEX and Cairn, with attacker IPs.
ThreatsUpdated
Japan's police and Germany's NRW confirm a 28-year-old Russian believed to lead Qilin was detained in Japan in May and handed to Germany on October 2.