Skip to content
JAENES

WORLD THREAT LANDSCAPE

The world threat landscape

Many of the breaches disclosed in Japan are tied to a cross-border cybercrime economy. What is happening worldwide, how are attackers organised, and where does stolen data go? We summarise the latest reports from public agencies and research firms.

ONION ROUTING

The “onion” behind the dark web

Tor wraps your traffic in three layers of encryption and routes it through three volunteer-run relays. Each relay peels off only one layer, so no single relay knows both who you are and where you are going — hence “onion routing.”

Connections to “.onion” sites never leave the Tor network, so no exit relay is used.[12]

01Global cyber threats in numbers

  • $4.99M

    Global average cost of a data breach (record high)[2]

  • 31%

    Exploited vulnerabilities — now the top initial access vector[1]

  • 48%

    Breaches involving ransomware[1]

  • 48%

    Breaches involving a third party[1]

  • $20.9B

    Internet crime losses reported to the FBI (2025)[6]

  • 1M+

    Complaints received (1,008,597, a record)[6]

Ransomware payments worldwide (crypto)[3][4][5]
$567M2022
$1.25B2023
$892M2024
$820M+2025

Chainalysis estimates. 2025 is “more than $820M” and is expected to be revised toward ~$900M as more payments are attributed. Only 28% of victims paid — a likely all-time low.

Ransomware reports in Japan (per half-year)[9]
114’22 H1
116’22 H2
103’23 H1
94’23 H2
114’24 H1
108’24 H2
116’25 H1
110’25 H2
123’26 H1

Reports to the National Police Agency. H1 2026 reached 123, the highest half-year since 2022.

Costliest internet crime types in the US (2025)[6]
  • Investment fraud$8.65B
  • Business email compromise$3.05B
  • Tech/customer support scams$2.13B
  • Personal data breach$1.31B
  • Romance scams$0.93B

From the FBI Internet Crime Complaint Center (IC3) annual report. Investment fraud and business email compromise lead.

02Types of attackers

“Hacker” originally meant a skilled technologist and includes defenders too. Here we sort the people behind attacks (threat actors) into four groups by motive.

  • Most common

    Cybercrime groups

    Motive: Money

    Organisations profiting from ransomware and fraud. Work is split among developers, intruders and money launderers, and ransomware-as-a-service (RaaS) rentals are now the norm.

  • Advanced

    State-backed groups (APT)

    Motive: Espionage, sabotage

    Groups that quietly target governments, critical infrastructure and advanced technology for long periods, using spear-phishing and unknown vulnerabilities.

  • DDoS-heavy

    Hacktivists

    Motive: Politics, causes

    Activists attacking for political or social causes, mostly with DDoS floods that knock websites offline. Activity rises with geopolitical events.

  • Close to home

    Insiders

    Motive: Grudges, money

    Employees or contractors misusing legitimate access. IPA lists insider leaks at #7 in its 2026 top threats for organisations.

In ENISA's 2026 Threat Landscape, 36% of recorded events were cybercrime, and over 89% of 4,709 hacktivist claims were DDoS.[7]

03Ransomware gang trends

GuidePoint Security counted 2,760 victims posted to leak sites in Q3 2026 (+21% quarter-on-quarter, +75% year-on-year) across 112 active groups. 42% of victims were in the US; manufacturing was the most hit sector.[8]Leak sites only list victims who refused to pay, so real numbers are higher.[11]

  • #1TheGentlemen12.9% of victims
  • #2Qilin12.6% of victims
  • GuidePoint GRIT Q3 2026

04Inside the dark web

The internet is often compared to an iceberg. Search engines see only the tip; below lies content behind logins, and deeper still the “dark web,” reachable only with special software.[12]

123

  1. 1Surface web

    Ordinary sites that search engines index — news, company websites and so on.

  2. 2Deep web

    Everything not indexed: online banking, email, member pages. Most of what you use daily lives here, and it's perfectly legal.

  3. 3Dark web

    A deliberately hidden part reachable only via anonymising tools such as Tor. Forums and markets there trade malware and stolen credentials.

How stolen data flows

  1. STEP 1

    Intrusion

    Vulnerability exploits, phishing or infostealer malware hijack credentials and devices.

  2. STEP 2

    Access for sale

    Initial access brokers sell entry points into breached corporate networks on underground markets.

  3. STEP 3

    The attack

    RaaS affiliates use the purchased access, steal data, then encrypt systems.

  4. STEP 4

    Leak and resale

    Non-paying victims are named on leak sites; stolen personal data is reused for further fraud and impersonation.

Chainalysis reports at least $14M paid to initial access brokers in 2025. The average access price fell from about $1,427 (Q1 2023) to $439 (Q1 2026), per Darkweb IQ — entry points are getting cheaper.[3]

05Law-enforcement takedowns

Police, prosecutors and private companies keep coordinating international operations against cybercrime infrastructure.

  1. 2024-02-20

    Operation Cronos[13]

    The UK NCA, the FBI and partners in 10 countries seized the infrastructure of LockBit, one of the largest ransomware gangs, and obtained 1,000+ decryption keys.

  2. 2024-05

    Operation Endgame[15]

    The largest-ever action against botnets: 100+ servers of five dropper families taken down and 4 arrests.

  3. 2024-10-01

    LockBit follow-up[14]

    Phase three of Cronos brought four new arrests and financial sanctions against affiliates.

  4. 2025-05-21

    Lumma Stealer[16]

    Microsoft, the US DOJ, Europol and Japan's JC3 disrupted ~2,300 domains of the Lumma infostealer; 394,000+ infected PCs were found in two months.

  5. 2025-06

    Archetyp Market[17]

    The longest-running dark-web drug market, with 600,000+ users, was shut down in five European countries.

  6. 2025-11

    Operation Endgame (round 3)[18]

    1,025 servers behind the Rhadamanthys infostealer, VenomRAT and others were taken down.

  7. 2026-03-04

    Tycoon 2FA[19]

    Microsoft, Europol and partners dismantled an MFA-bypassing phishing-as-a-service platform and seized 330 domains.

  8. 2026-04

    Operation PowerOFF[20]

    21 countries targeted DDoS-for-hire services, identifying 75,000+ users and taking down 53 domains.

06The situation in Japan

123

Ransomware reports in Japan, H1 2026

Japan's National Police Agency received 123 ransomware reports in H1 2026, plus 9 “no-ware ransom” cases where data was stolen without encryption. Full-year 2025 saw 226 reports, with manufacturing (91) hit most.[9]

IPA “10 Major Security Threats 2026” — organisations[10]

  1. 1Ransomware attacks
  2. 2Attacks on supply chains and contractors
  3. 3Cyber risks around the use of AINew
  4. 4Exploitation of system vulnerabilities
  5. 5Targeted attacks on confidential information
  6. 6Geopolitically driven cyberattacks (incl. information warfare)
  7. 7Insider data leaks
  8. 8Attacks on remote-work environments
  9. 9DDoS attacks
  10. 10Business email compromise

The list for individuals is unranked: ten items, including phishing and support scams, in Japanese syllabary order.

What individuals can do

  • Stop reusing passwords; turn on passkeys or MFA (blocks reuse of stolen credentials)
  • Enable automatic updates for your OS, browser and router (blocks the top intrusion vector)
  • Save passwords in browsers only on trusted devices and avoid dubious software (against infostealers)
  • When you get a “breach notice,” verify on the official site instead of using email links

Read the protection guide →Search Japanese incidents (Japanese) →

Sources

  1. [1]Verizon 2026 Data Breach Investigations Report(Executive Summary)
  2. [2]IBM Cost of a Data Breach Report 2026(IBM Newsroom 2026-07-29)
  3. [3]Chainalysis 2026 Crypto Crime Report — Ransomware
  4. [4]Chainalysis 2025 Crypto Crime Report — Ransomware
  5. [5]Chainalysis 2024 Crypto Crime Report — Ransomware
  6. [6]FBI IC3 Internet Crime Report 2025
  7. [7]ENISA Threat Landscape 2026
  8. [8]GuidePoint Security GRIT Q3 2026 Ransomware & Cyber Threat Report
  9. [9]警察庁「令和8年上半期におけるサイバー空間をめぐる脅威の情勢等について」
  10. [10]IPA「情報セキュリティ10大脅威 2026」
  11. [11]CISA Advisory AA23-165A(LockBit / RaaS)
  12. [12]Cisco Talos「What is the dark web?」
  13. [13]UK NCA — Operation Cronos(LockBit)
  14. [14]Europol — LockBit power cut(2024-10)
  15. [15]Europol — Operation Endgame(2024-05)
  16. [16]Microsoft — Lumma Stealer disruption(2025-05-21)
  17. [17]Europol — Archetyp Market takedown(2025-06)
  18. [18]Europol — Operation Endgame(2025-11)
  19. [19]Microsoft — Tycoon 2FA disruption(2026-03-04)
  20. [20]Europol — Operation PowerOFF(2026-04)

Figures checked on October 20, 2026. Each report differs in scope, period and method, so the figures cannot be compared directly. See each source for the latest information.