Japan’s Active Cyber Defense Framework Expands Reporting and Threat-Disruption Powers
Summary
Japan’s Active Cyber Defense framework introduces mandatory reporting for designated critical infrastructure operators on October 1, 2026. Communications-analysis powers follow in 2027; the report assesses implementation, oversight, threat activity, and operational gaps
Key points
- Acts 42 and 43 of 2025 establish four pillars: public-private cooperation, communications-information use, access and neutralization measures, and institutional restructuring with independent oversight.
- Designated critical infrastructure operators using covered systems must notify the government and report qualifying incidents starting October 1, 2026; existing systems have six months for initial notifications.
- Government communications-information authorities take effect by November 23, 2027, creating an approximately 13-month gap after reporting begins.
- The framework permits narrowly defined action against systems used for malicious activity, subject to urgent-need requirements and generally prior approval by an independent oversight commission.
- The report identifies Chinese strategic collection, North Korean revenue-driven operations, and Russian espionage and disruptive activity as continuing threats to Japan.
- The authors assess that linking indicators across victims, suppliers, carriers, hosting providers, and government agencies will be a key operational constraint.
- Foreign subsidiaries, non-designated suppliers, employees, consumer platforms, and dispersed hosting infrastructure may remain less visible or outside direct reporting duties, so organizations should prepare escalation, evidence-preservation, and information-sharing processes.
Article Details
- Publisher
- Recorded Future
- Scope
- Japan’s Active Cyber Defense framework, implementation obligations, state-linked threats, and public-private intelligence coordination.
- Key Statistics
- Mandatory reporting begins on 2026-10-01; communications-information authorities take effect on 2027-11-23, approximately 13 months later. Operators with existing covered systems have six months to submit initial notifications.
- An NCO briefing citing NICT reported cyberattack-related packets increasing from 63.2 billion in 2015 to 686.2 billion in 2024, approximately elevenfold. These are sensor-observed packets, not confirmed discrete attacks.
- An NCO briefing citing NPA reported that 99.4% of observed attack packets in 2024 used overseas source IP addresses; this does not establish attackers’ physical locations.
- Authorities attributed the 2024 DMM Bitcoin theft of 4,502.9 BTC, worth approximately ¥48.2 billion or $308 million at the time, to TraderTraitor.
- Insikt Group identified 105 distinct IP addresses likely geolocated in Japan and associated with C2 observations over the preceding five years, spanning 40 autonomous system numbers. Of these, 77 (73.3%) were associated with hosting networks; the remaining 28 were unresolved. Geolocation did not establish physical location, actor control, or targeting of Japan.
- Recommendations
- Maintain independent monitoring, incident recognition, and escalation processes; treat government warnings as supplementary rather than a substitute.
- Prepare designated operators to submit covered-system notifications and report qualifying incidents.
- Align cross-border incident escalation so Japanese entities can recognize reportable activity affecting covered domestic systems even while overseas investigations remain incomplete.
- Update contracts, incident-response plans, evidence-preservation procedures, and information-sharing arrangements across suppliers, overseas affiliates, carriers, and hosting providers.
- Establish tested coordination channels with providers and participating organizations to preserve relevant records and convert shared infrastructure observations into timely, lawful defensive action.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationMirrorFace exploited VPN appliances and external servers; JPCERT/CC confirmed exploitation of CVE-2022-1388 on internet-facing F5 BIG-IP devices in activity assessed as related to BlackTech.T1199 · Trusted RelationshipA joint advisory reported that BlackTech compromised overseas subsidiary routers and abused trusted connections to reach headquarters networks.T1204.002 · Malicious FileTraderTraitor reportedly supplied a malicious Python script disguised as a pre-employment test; GhostHire also delivered malicious coding tests.T1498 · Network Denial of ServiceRecorded Future attributed a 2024-02-19 DDoS attack against Japanese government websites to NoName057(16) and Russian Cyber Army.T1550.004 · Web Session CookieTraderTraitor used stolen session-cookie information to impersonate a Ginco employee and access its communications system.T1566.001 · Spearphishing AttachmentMicrosoft observed BlueBravo sending spearphishing emails containing malicious RDP file attachments.
CVE
CVE-2022-1388Japan Computer Emergency Response Team Coordination Center (JPCERT/CC) confirmed attacks exploiting CVE-2022-1388 on F5 BIG-IP devices at Japanese organizations; the affected organizations confirmed that data storedCVE-2024-24919The activity appeared opportunistic; its timing, after the publication of proof-of-concept code for CVE-2024-24919, suggested a possible exploitation attempt, but we could not identify the Japanese organizations.
People
Threat Actors
APT38Identified as an alternate name for BlueNoroff, to which Kaspersky attributed GhostCall and GhostHire with medium-high confidence.BlackTechAlso identified as Tag-51. JPCERT/CC assessed BIG-IP exploitation activity as related to this actor; a separate joint advisory described PRC-linked compromises of overseas subsidiary routers.BlueBravoAlso identified as Midnight Blizzard. Microsoft observed malicious RDP-attachment spearphishing against organizations in multiple countries, including Japan; no Japanese compromise was publicly confirmed.BlueNoroffAlso identified as APT38. Kaspersky attributed GhostCall and GhostHire to this actor with medium-high confidence and reported infected hosts and individual victims in Japan.Earth KashaIdentified as an alternate name for MirrorFace, which Japanese authorities linked to suspected Chinese information-theft operations.Lazarus GroupJapanese agencies warned in 2022 that attacks similar to those associated with this group had targeted Japanese cryptocurrency exchanges for several years.Midnight BlizzardIdentified as an alternate name for BlueBravo. Microsoft attributes it to Russia’s Foreign Intelligence Service; the report does not establish specific government direction of Japanese targeting.MirrorFaceAlso identified as Earth Kasha. A Japanese alert assessed suspected Chinese involvement in information-theft activity against national-security and advanced-technology targets since approximately 2019.NoName057(16)Recorded Future attributed a February 2024 DDoS attack against Japanese government websites to this group and Russian Cyber Army. US allegations of Russian government financial backing were not adjudicated findings.PurpleDeltaInsikt Group tracking name for North Korean fraudulent IT-worker activity discussed as generating revenue for prohibited weapons programs.RedDeltaRecorded Future observed Japan-based IP addresses communicating with its known PlugX servers and reported targeting of Japan-based Mongolian Buddhist activists and academics.RedNovemberInsikt Group observed its infrastructure communicating with Check Point VPN gateways in 2024, including gateways associated with Japan. Possible exploitation was suspected, not confirmed.Russian Cyber ArmyInsikt Group’s name for an actor to which Recorded Future attributed a 2024-02-19 DDoS attack against Japanese government websites alongside NoName057(16).Tag-51Identified as an alternate name for BlackTech, associated with exploitation and abuse of trusted cross-border network connections.TAG-71Insikt Group identified a North Korea-linked infrastructure cluster spoofing financial and venture-capital organizations in Japan, Vietnam, and the US to support phishing, malware delivery, and C2.TraderTraitorNorth Korean actors to whom Japanese and US authorities attributed the DMM Bitcoin theft, involving a Ginco employee compromise and stolen session cookies.Volt TyphoonIts botnet was subject to a US court-authorized takedown in 2024, cited as a comparison for infrastructure-neutralization authorities.
Malware
Vendors
BGPNETThe web hosting providers include a large US hyperscaler, Vultr/The Constant Company, BGPNET, xTom Japan, CTG Server, and Cloudie.Check PointFrom June 3 through 6, 2024, Insikt Group observed outbound communications from a RedNovember IP address to Check Point VPN gateways associated with at least 60 organizations, primarily in six countries, including Japan.CloudieThe web hosting providers include a large US hyperscaler, Vultr/The Constant Company, BGPNET, xTom Japan, CTG Server, and Cloudie.CTG ServerThe web hosting providers include a large US hyperscaler, Vultr/The Constant Company, BGPNET, xTom Japan, CTG Server, and Cloudie.F5Emergency Response Team Coordination Center (JPCERT/CC) confirmed attacks exploiting CVE-2022-1388 on F5 BIG-IP devices at Japanese organizations; the affected organizations confirmed that data stored on theGincoAn actor reportedly posed as a recruiter, contacted a Ginco employee via LinkedIn, and sent a malicious Python script, disguised as a pre-employment test, through GitHub.MicrosoftAcross the observed intrusions, MirrorFace compromised Active Directory and accessed Microsoft 365 and virtualization servers, with some activity persisting into 2024.The Constant CompanyThe web hosting providers include a large US hyperscaler, Vultr/The Constant Company, BGPNET, xTom Japan, CTG Server, and Cloudie.VultrThe web hosting providers include a large US hyperscaler, Vultr/The Constant Company, BGPNET, xTom Japan, CTG Server, and Cloudie.xTom JapanThe web hosting providers include a large US hyperscaler, Vultr/The Constant Company, BGPNET, xTom Japan, CTG Server, and Cloudie.
Products
Active DirectoryAcross the observed intrusions, MirrorFace compromised Active Directory and accessed Microsoft 365 and virtualization servers, with some activity persisting into 2024.F5 BIG-IPEmergency Response Team Coordination Center (JPCERT/CC) confirmed attacks exploiting CVE-2022-1388 on F5 BIG-IP devices at Japanese organizations; the affected organizations confirmed that data stored on the devicesGitHubAn actor reportedly posed as a recruiter, contacted a Ginco employee via LinkedIn, and sent a malicious Python script, disguised as a pre-employment test, through GitHub.LinkedInAn actor reportedly posed as a recruiter, contacted a Ginco employee via LinkedIn, and sent a malicious Python script, disguised as a pre-employment test, through GitHub.macOSIts telemetry detected several GhostCall-infected macOS hosts in Japan and identified individuals in Japan and Australia as GhostHire victims.Microsoft 365 Apps for EnterpriseAcross the observed intrusions, MirrorFace compromised Active Directory and accessed Microsoft 365 and virtualization servers, with some activity persisting into 2024.Microsoft TeamsGhostCall threat actors posed as investors and used fraudulent Zoom or Microsoft Teams meetings to conduct phishing attacks, whereas GhostHire threat actors posed as recruiters and delivered malicious coding tests viaTelegramattacks, whereas GhostHire threat actors posed as recruiters and delivered malicious coding tests via Telegram bots, GitHub repositories, or ZIP archives.ZoomGhostCall threat actors posed as investors and used fraudulent Zoom or Microsoft Teams meetings to conduct phishing attacks, whereas GhostHire threat actors posed as recruiters and delivered malicious coding tests via
Countries
Australiain 2022, the United Kingdom (UK) enacted the Network and Information Systems Regulations in 2018, and Australia enacted the Security of Critical Infrastructure Act in 2018.ChinaChinese, Russian, and North Korean cyber operations targeting Japan reflect distinct primary drivers: China pursues enduring strategic intelligence collection, North Korea prioritizes sanctions-driven revenueJapanJapan’s Active Cyber Defense (ACD) framework shifts the country from voluntary information sharing and post-incident investigation to mandatory reporting, preventive communications analysis, and limited disruption ofNorth KoreaJapan reflect distinct primary drivers: China pursues enduring strategic intelligence collection, North Korea prioritizes sanctions-driven revenue generation, and Russia combines standing espionage requirementsRussiastrategic intelligence collection, North Korea prioritizes sanctions-driven revenue generation, and Russia combines standing espionage requirements with disruption that can track Japanese policy decisions.UkraineTokyo has taken steps to maintain access to Sakhalin-2 gas exports, despite sanctioning Russia following the Russian full-scale invasion of Ukraine.United Kingdom(US) enacted the Cyber Incident Reporting for Critical Infrastructure Act in 2022, the United Kingdom (UK) enacted the Network and Information Systems Regulations in 2018, and Australia enacted the Security ofUnited StatesOn mandatory reporting and public-private coordination, the United States (US) enacted the Cyber Incident Reporting for Critical Infrastructure Act in 2022, the United Kingdom (UK) enacted the Network and InformationVietnamand six malicious files in a cluster that spoofed financial and venture-capital organizations in Japan, Vietnam, and the US.
Industries
AcademicThe threat actor used phishing and exploited VPN appliances and external servers across government, political, media, academic, manufacturing, telecommunications, semiconductor, and aerospace targets.Aerospacehospital ransomware attack, the 2023 Nagoya Port ransomware attack, sustained intrusions into the Japan Aerospace Exploration Agency (JAXA) spanning 2021–2024, and the 2022 exfiltration of email data from the NationalCryptocurrencyfraudulent IT-worker employment schemes important instruments of state policy, using them to steal cryptocurrency, generate foreign currency, evade international sanctions, and acquire sensitive information.DefenseJapan’s Active Cyber Defense (ACD) framework shifts the country from voluntary information sharing and post-incident investigation to mandatory reporting, preventive communications analysis, and limited disruption ofElectricityComputers (ç¹å®éè¦é»åè¨ç®æ©). These include qualifying operators in sectors such as electricity, telecommunications, transport, and finance. Designated critical-infrastructure operators must notifyfinanceThese include qualifying operators in sectors such as electricity, telecommunications, transport, and finance. Designated critical-infrastructure operators must notify the responsible government minister when theyGovernmentinfrastructure. Beginning October 1, 2026, designated critical infrastructure operators must notify the government about covered systems and report qualifying incidents; those with existing systems have six months toHealthcareBetween 2021 and 2024, multiple high-profile cyberattacks targeted Japanese public and private entities, including healthcare, transportation, research, and government organizations.Higher EducationThe campaign targeted government agencies, higher education, defense organizations, and NGOs in dozens of countries, including Australia, Europe, the UK, and Japan.ManufacturingThe threat actor used phishing and exploited VPN appliances and external servers across government, political, media, academic, manufacturing, telecommunications, semiconductor, and aerospace targets.MediaThe threat actor used phishing and exploited VPN appliances and external servers across government, political, media, academic, manufacturing, telecommunications, semiconductor, and aerospace targets.ResearchBetween 2021 and 2024, multiple high-profile cyberattacks targeted Japanese public and private entities, including healthcare, transportation, research, and government organizations.semiconductorThe threat actor used phishing and exploited VPN appliances and external servers across government, political, media, academic, manufacturing, telecommunications, semiconductor, and aerospace targets.TechnologyProtection Measures (éä¿¡é²è·æªç½®) jointly with police, but only when the JSDF’s specialized technology or information is indispensable, and the National Public Safety Commission has requested or consentedTelecommunications(ç¹å®éè¦é»åè¨ç®æ©). These include qualifying operators in sectors such as electricity, telecommunications, transport, and finance. Designated critical-infrastructure operators must notify the responsibleTransportationThese include qualifying operators in sectors such as electricity, telecommunications, transport, and finance. Designated critical-infrastructure operators must notify the responsible governmentventure-capitalresolving to five IP addresses and six malicious files in a cluster that spoofed financial and venture-capital organizations in Japan, Vietnam, and the US.Web hostingThe web hosting providers include a large US hyperscaler, Vultr/The Constant Company, BGPNET, xTom Japan, CTG Server, and Cloudie.