JSAC 2026 Day 2 Highlights Research on Phishing, Botnets and Ransomware
Summary
JPCERT/CC recaps JSAC 2026 Day 2 presentations on forensic journal analysis, phishing services, residential proxies, RapperBot, a WSUS exploit incident, Silver Fox malspam and Qilin ransomware.
Key points
- A demonstration of FJTA showed how ext4 and XFS journal records can help reconstruct file activity when timestamps are unreliable; the presenter recommended prioritizing journal acquisition during incident response.
- Researchers described CoGUI phishing operations and its FishingMaster platform, which reportedly resumed under new names after a temporary suspension, and highlighted URL and API patterns for threat hunting.
- Presenters outlined how phishing admin panels support site setup, stolen-data management and OTP bypass, and said identifying the panels themselves may disrupt PhaaS operations.
- RapperBot research linked a blacklist function to the end of repeat attacks and the operator’s arrest; the botnet primarily targets DVRs and network cameras.
- An analysis of an October 2025 attack on a Japanese company found WSUS RCE (CVE-2025-59287) was likely used for initial access, followed by abuse of Velociraptor as an RMM tool.
- A campaign attributed to Silver Fox targeted Japanese organizations with phishing emails that delivered ValleyRAT and VShell through a multi-stage infection chain.
- The Qilin presentation described credential abuse, lateral movement, data theft and encryption, emphasizing early detection, MFA, offline backups and comprehensive logging.
Article Details
- Attack Vectors
- CoGUI phishing campaigns target Japanese financial, transportation, and government-service brands; the operators resumed under names including NX and FA.
- Phishing admin panels support site configuration, stolen-information management, cloaking, domain management, and one-time-password bypass.
- RapperBot propagates through multiple scanners and primarily targets DVRs and network cameras; its operators use C2 servers to coordinate DDoS attacks.
- An attack on a Japanese company in October 2025 began with exploitation of CVE-2025-59287 in WSUS; Velociraptor was deployed via an MSI installer and abused as an RMM tool.
- Silver Fox-attributed malspam used embedded URLs, intermediary redirects, a loader, and additional payloads, including ValleyRAT and VShell.
- Qilin initial access involved leaked credentials obtained through messaging applications, marketplace forums, and initial access brokers, followed by reconnaissance, lateral movement, credential theft, RMM abuse, data exfiltration, and encryption.
- Defensive Notes
- Prioritize collecting file-system journal data after acquiring a memory image; journal analysis can complement conventional timeline analysis.
- Identify characteristic phishing URL and API patterns, track related infrastructure, and conduct proactive threat hunting.
- Address phishing admin panels as well as individual phishing sites; identifying and taking down the panels may disrupt the service.
- Reduce the number of vulnerable IoT devices to limit botnet infections.
- Strengthen detection and review defensive configurations in response to the WSUS incident; correlate alerts with process-tree analysis and network indicators.
- Monitor Japanese-language phishing emails, detect and block anomalous communications, and conduct continuous threat analysis.
- For ransomware defense, collect logs comprehensively, enforce MFA, maintain offline backups, configure security products proactively, and strengthen detection with Sigma and YARA rules.
CVE
People
Albert SongPresented analysis of CoGUI and the FishingMaster platform.Hideyuki FurukawaPresented analysis of RapperBot C2 operations and DDoS attacks.Lime ChenPresented analysis of CoGUI and the FishingMaster platform.Masaomi MasumotoPresented methods and technical mechanisms for building phishing admin panels.Minoru KobayashiPresented research on reconstructing file activity from ext4 and XFS journals and demonstrated FJTA.Paul ZieglerCo-presented research on domestic residential proxy services and their abuse.Satoshi KamekawaPresented analysis of a phishing campaign attributed to Silver Fox.Shadow LiuPresented analysis of CoGUI and the FishingMaster platform.Shohei IwataCo-presented the incident analysis of an attack exploiting CVE-2025-59287.Takahiro TakedaPresented analysis of Qilin’s attack lifecycle and ransomware incidents.Teruki YoshikawaCo-presented the incident analysis of an attack exploiting CVE-2025-59287.Yuji InoPresented research on domestic residential proxy services and their abuse.
Threat Actors
Oriental GudgeonNamed as a case study involving phishing-as-a-service infrastructure.QilinIdentified as a ransomware group associated with domestic incidents in Japan and activity globally.Silver FoxThe article attributes a September–October 2025 malspam campaign targeting Japanese organizations to Silver Fox; the attribution is described as likely.
Malware
Products
Dockeradmin panels, highlighting that they are designed for rapid deployment and removal through the use of Docker and automated installation scripts.EDRAt the outset, there was no clear information regarding the infection vector, and the true initial point of compromise could not be readily determined based solely on EDR telemetry.ext4Following the Trace: Reconstructing Attacks from Ext4 and XFS JournalsSigmabackups, proactive configuration of security products, and strengthened detection through the use of Sigma and YARA rules.The Sleuth KitIt was also noted as a challenge that existing tools such as The Sleuth Kit only provide data enumeration.Velociraptorintelligence collection, as well as attribution analysis based on TTP evidence, including the abuse of Velociraptor.WSUSUnraveling the WSUS Exploit Chain: Incident Analysis and Actor InsightsXFSFollowing the Trace: Reconstructing Attacks from Ext4 and XFS JournalsYARAproactive configuration of security products, and strengthened detection through the use of Sigma and YARA rules.
Tools
FJTAThrough a demonstration of the journal analysis tool “FJTA (Forensic Journal Timeline Analyzer),” developed for this purpose, the presentation highlighted the effectiveness of journal analysis in complementingSignalPrimary intrusion vectors included the abuse of leaked credentials obtained through encrypted messaging applications such as Telegram and Signal, marketplace forums, and initial access brokers.TelegramPrimary intrusion vectors included the abuse of leaked credentials obtained through encrypted messaging applications such as Telegram and Signal, marketplace forums, and initial access brokers.
Countries
CanadaIt was further explained that Qilin has expanded its activities globally, including in the United States, Canada, China, and South Korea, and remains highly active, continuously publishing victim organizations on itsChinaJapanese brands in the financial, transportation, and government service sectors, as well as of the China-based Phishing-as-a-Service (PhaaS) platform “FishingMaster (垂钓大师)” behind its operations.JapanSpeaker: Minoru Kobayashi, Internet Initiative Japan Inc.South Koreathat Qilin has expanded its activities globally, including in the United States, Canada, China, and South Korea, and remains highly active, continuously publishing victim organizations on its leak site.Taiwanand data collected through honeypots, confirmed a large number of infections in regions such as Taiwan, the United States, and Japan, and revealed the large-scale operation of its C2 servers.United Statescollected through honeypots, confirmed a large number of infections in regions such as Taiwan, the United States, and Japan, and revealed the large-scale operation of its C2 servers.
Industries
Financial ServicesGovernmentphishing campaign “CoGUI,” which targets numerous Japanese brands in the financial, transportation, and government service sectors, as well as of the China-based Phishing-as-a-Service (PhaaS) platform “FishingMasterOnline gamingTransportationanalysis of the phishing campaign “CoGUI,” which targets numerous Japanese brands in the financial, transportation, and government service sectors, as well as of the China-based Phishing-as-a-Service (PhaaS) platform