Cisco Talos identifies Japan as particularly pressured by ransomware during 2025. The report tallies 134 incidents, an 17.5% increase over the previous year, and singles out Qilin as one of the more active players.
According to cited data, 22 of these cases were attributed to Qilin, representing 16.4% of the total. That share makes the group a useful reference for understanding how campaigns are evolving: greater activity, higher specialization, and an operation with scalability capabilities.
The report’s interest lies not just in the aggregated figures but in what they suggest for defense: when an actor concentrates a visible portion of incidents, studying their patterns can help improve early detection and sector readiness.