Japan has become a significant target for state-sponsored attacks amid rising political and diplomatic tensions, according to a newly published report.
Rapid7 (NASDAQ: RPD), a leader in cloud risk and threat detection, today released the Rapid7 Japan Cyber Threat Landscape Report, focusing on the Asian country's global business footprint.
It highlights that Japanese businesses are a significant target for state-sponsored attacks. Along with political division, the report shows that this increased vulnerability has been driven by a fragile global economy.
As well as detailing why Japanese businesses are being increasingly targeted, the report details the Tactics, Techniques and Procedures (TTPs) of different state-sponsored groups and their common trends, why the Japanese automotive industry and financial services sector are of particular interest to these actors, and what can be done to secure Japanese businesses and their subsidiaries.
Rapid7 researchers observed for example that, as of late 2022 and early 2023, LockBit 3.0 ransomware operators were specifically targeting Japanese organisations — particularly Japanese manufacturers. The prevalence of manufacturing within Japan makes it the leading target for ransomware groups and nation-states, whereas healthcare is the most common target in other parts of the world.
“Manufacturing organisations have a low tolerance for downtime or any other type of operational disruption, and ransomware operators know that makes them vulnerable to extortion,” said Paul Prudhomme, Rapid7 principal security analyst and Japan Cyber Threat Landscape Report author. “When a Japanese manufacturer’s operations are disrupted, it can have supply chain implications worldwide, as many other manufacturers depend on supplies of Japanese components.”
Read more about security, risk and cybercrime on our dedicated Business Continuity page
As the world’s third-largest economy after the U.S. and China, Japan is home to global corporations with complex networks of overseas operations that include subsidiaries, third-party suppliers, and other affiliates. This is of particular interest, as the Rapid7 report also notes that many of the most recent compromises of Japanese companies began with unauthorised access to a subsidiary, at which point the attacker was able to move laterally into the parent company’s network.
“As the parent company brings new subsidiaries and affiliates into its fold, there are likely to be visibility issues that can inhibit proper risk management and mitigation,” said Prudhomme.
Rapid7 recommends that Japanese businesses with a global footprint follow specific steps outlined in the report’s Recommendations section, to reduce their risk of exposure to ransomware and other advanced cyber threats.
To access the complete Rapid7 Japan Cyber Threat Landscape Report and related resources, click here.
