Japanese companies exposed to increased ransomware risk
Rapid7, a leader in cloud risk and threat detection, has released a new cyber threat landscape report focused on Japan and its global business footprint.
The Rapid7 Japan Cyber Threat Landscape Report highlights Japanese businesses' unique threat profile, which has led to an increase in instances of sensitive data loss and business disruption via ransomware.
Rapid7 researchers observed for example that, as of late 2022 and early 2023, LockBit 3.0 ransomware operators were specifically targeting Japanese organisations — particularly Japanese manufacturers. The prevalence of manufacturing within Japan makes it the leading target for ransomware groups and nation states, whereas healthcare is the most common target in other parts of the world.
"Manufacturing organisations have a low tolerance for downtime or any other type of operational disruption, and ransomware operators know that makes them vulnerable to extortion," says Paul Prudhomme, Rapid7 principal security analyst and Japan Cyber Threat Landscape Report author.
"When a Japanese manufacturer's operations are disrupted like this it can have supply chain implications worldwide, as many other manufacturers depend on supplies of Japanese components," he says.
Risk of overseas entities
According to the report, as the world's third largest economy, Japan is home to global corporations with complex networks of overseas operations in countries like Australia, that include subsidiaries, third party suppliers, and other affiliates.
In addition to its findings on ransomware, the report notes that many of the most recent compromises of Japanese companies began with unauthorised access to a subsidiary, at which point the attacker was able to move laterally into the parent company's network.
"As the Japanese parent company brings new subsidiaries and affiliates into its fold, there are likely to be visibility issues that can inhibit proper risk management and mitigation," says Prudhomme.
According to Rob Dooley, Vice President, Asia Pacific and Japan at Rapid7', it is common for cyber adversaries to pursue access to a company through a roundabout route.
"Island hopping is growing in popularity with perpetrators 'hopping' through a series of intermediary steps to achieve their end objectives," Dooley says.
"This includes indirectly targeting the intended victim organisation via the more vulnerable locations to undermine the parent company's cyber defences and gain access to their network," he says.
"Rapid7 recommends that Japanese businesses with extensive foreign operations, subsidiaries, or other holdings follow the specific steps outlined in the report's recommendations to reduce their risk to ransomware and other advanced cyber threats."
