Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use

What it is

Cisco Talos documents a six-phase attack chain used by a Gentlemen ransomware affiliate, reconstructed from .bash_history recovered on an open directory, plus specific indicators distinguishing the group's AdaptixC2 C2 framework and exfiltration tooling.

How it works

The phases, as sequenced in the bash history:

1. Platform setup – VPN, Chisel, and Ligolo-ng turn the actor's own server into an attack platform.
2. Recon – Masscan/Nmap sweep exposed hosts, VPN ports, web, SMB; NetExec enumerates SMB shares, LDAP, and AD computer info; RustHound/BloodHound maps AD paths for lateral movement and privesc.
3. Exploitation – CVE-2025-24799 (unauthenticated GLPI SQLi) exploited via PoC + sqlmap to pull user data; a cPanel/WHM auth-bypass PoC is also run. (CVE-2025-2479 exploit code was present in the directory but not tied to a confirmed exploitation step in the history.)
4. Credential access – Responder, NTLM-relay tools, Impacket, NetExec deployed; traces indicate Zerologon (CVE-2020-1472) and MS17-010 (EternalBlue) exploitation.
5. Lateral movement – Chisel/Ligolo-ng/SSH/Proxychains tunnels plus NetExec/Impacket auth attempts against SMB, LDAP, RDP, WinRM to reach AD management infrastructure.
6. Exfiltration – Backup share mounted via CIFS at /mnt/Backup; libguestfs-tools, qemu-utils, nbd-client installed to mount VHDX images at /mnt/vhdx; ntds.dit, SAM, SYSTEM copied out and run through secretsdump.py to produce ntds.txt/SAM.txt. Data is zstd-compressed and uploaded to Wasabi via rclone, split into 256MiB chunks with up to 16 concurrent uploads, retries, timeouts, and file logging — i.e., deliberately tuned for large-volume transfer reliability.

After each phase the actor deletes credential dumps, scan output, and pivoting tool artifacts from their own server.

flowchart LR
    A[Platform setup<br/>VPN/Chisel/Ligolo] --> B[Recon<br/>Masscan/Nmap/NetExec/BloodHound]
    B --> C[Exploitation<br/>CVE-2025-24799 GLPI SQLi]
    C --> D[Credential access<br/>Responder/Zerologon/MS17-010]
    D --> E[Lateral movement<br/>NetExec/Impacket to SMB/LDAP/RDP/WinRM]
    E --> F[Exfil<br/>VHDX mount -> secretsdump -> rclone to Wasabi]

Preconditions / Affected

Relevant to orgs with internet-exposed GLPI instances (CVE-2025-24799), unpatched AD domain controllers (Zerologon), legacy SMBv1 (MS17-010), and CIFS-mounted Windows Server Backup shares storing VHDX images containing ntds.dit.

What to do

• Patch GLPI against CVE-2025-24799 and CVE-2025-2479; patch domain controllers for Zerologon (CVE-2020-1472); disable SMBv1 to close MS17-010.
• Restrict/monitor CIFS access to backup shares holding VHDX files — this is the specific exfil path used (not just "protect backups" generically).
• Watch for AdaptixC2 traffic: it supports HTTP/S, DNS/DoH, and SMB C2 channels — a legitimate red-team framework being repurposed here.
• Detection: Snort SIDs 1:67111 (Snort 2) and 7:29 (Snort 3) cover this threat per Talos coverage.

Caveats

Russian-speaking-operator attribution rests on a Russian-language code comment and Cyrillic-keyboard mistyped commands (e.g., црщфьш for whoami) found in one actor's .bash_history — Talos ties this to one affiliate's infrastructure, not necessarily the whole RaaS operation.