There is no indication that ransomware assaults against Japanese businesses will stop. Major online retailer Askul Corp. experienced a cyberattack in October that resulted in system interruptions, following an attack on Asahi Group Holdings Ltd. Government authorities are finding it difficult to keep up with the situation.

The ransomware profit 

According to some estimates, a complete system recovery could take several months. Asahi is thought to have been employing a large-scale operations system that linked ordering, shipping, human resources, and accounting administration. 

A hacker collective known as Qilin claimed responsibility for this most recent attack in a statement released on a dark web website on October 27. The group claimed to have stolen approximately 9,300 files totaling at least 27 gigabytes, and they shared 29 photos that they felt showed Asahi's internal documents and employee personal information.

About Quilin

Qilin is thought to be a hacker collective with ties to Russia that was established around 2022. The gang reportedly released over 700 statements claiming responsibility for ransomware attacks in 2025 alone, when it started to become more active. 

Additionally, Qilin uses a business model called "Ransomware as a Service" (RaaS), whereby it offers third parties ransomware programs and attack techniques as a service. Even anyone without a high level of technological competence can conduct assaults utilizing RaaS. 

The creation of ransomware and the implementation of the attacks have been split between many players who split ransom payments, whereas in the past, virus writers frequently carried out the operations individually. These company strategies seem to have gained popularity in recent years.

Attack tactics

Hackers typically breach a company's networks to prevent access to data and threaten to release it. This is referred regarded as a double extortion strategy. 

To make businesses pay, some hackers even go so far as to use triple or quadruple extortion. These include direct threats to the targeted company's clients and business partners or frequent distributed denial-of-service (DDoS) attacks that flood servers with data.  

According to reports, these techniques are become more malevolent. The majority of specialists concur that payments should not be made in principle, and even if a business pays the ransom, there is no assurance that the data would be released.