Cyber Security Report - September 2026
Research by OSINT Monitoring Team, NTT Security Japan K.K
Table Contents
1.1. Overview
1.2. Public Attribution (Identification and Disclosure of Attack Actors)
1.4. Disguised Employment by North Korean IT Workers
1.5. Points of Connection Between the Two Activities and Damage Situation
U.S. Government Warns of Large-Scale AI Distillation Campaign by Chinese AI Companies
2.2. What is distillation in AI?
2.3. Distillation Campaign by Chinese AI Companies and U.S. Government Warnings
Unauthorized access to the Digital Agency Government Solution Service
3.2. Exploited Vulnerabilities and Incident Background
3.3. Challenges in Information Disclosure
3.4. Risks Associated with GSS Infringement
Disclaimer
This report selects and summarizes three particularly important topics from various information security-related incidents and events that occurred during September 2026, as well as the changes in the surrounding environment. The main points of each topic are as follows.
Chapter 1: 'National Police Agency Issues Warning: Actual Activities of the North Korean-Based Attack Group 'WaterPlum''
On September 18, 2026, the National Police Agency and the National Cyber Office, together with relevant authorities from the United States, Australia, and Germany, issued a warning about malicious cyber activities by North Korea. Among them, detailed methods were revealed regarding attacks by the cyberattack group "WaterPlum" and foreign currency acquisition activities by North Korean IT workers through disguised employment.
The National Police Agency was the first in Japan to identify, investigate, and dismantle a 'laptop farm' that had been used for fake employment by North Korean IT workers. North Korean IT workers remotely operated PCs installed in supporters' homes to fake their actual locations and work locations, and received orders from companies outside North Korea.
It is important to view the risks of North Korean cyberattacks and the risks of involvement in the country's activities through recruitment and outsourcing as integrated threats, and to implement countermeasures not only in IT departments but also across the entire organization, including those involved in human resource management.
Chapter 2: 'U.S. Government Warns of Large-Scale AI Distillation Campaign by Chinese AI Companies'
On September 8, 2026, the U.S. government released a joint recommendation regarding a large-scale AI distillation campaign by Chinese AI companies. It points out that Chinese AI companies are continuously and systematically extracting capabilities and functions from advanced U.S. AI models, warning of national security concerns. Since the direction of AI policy remains unclear, it is desirable to continuously monitor changes not only in AI technology but also in institutional aspects.
Chapter 3: 'Unauthorized Access to the Digital Agency Government Solution Service'
In September 2026, the Digital Agency announced that unauthorized access to Government Solution Services (GSS), the government's common infrastructure, may have resulted in the possible leakage of approximately 246,000 personal information. The attack exploited vulnerabilities in VPN devices.
The Digital Agency did not disclose the name of the VPN product or vulnerability information, and since it took about two and a half months from detection to disclosure of unauthorized access, issues remained regarding the specificity and speed of information disclosure.
Violations of GSS can expand the impact on multiple user organizations and lead to national security risks. This case demonstrated that continuous operational improvement and strengthening of monitoring systems are essential even in a zero-trust environment.
National Police Agency issues warning: Actual activities of the North Korean-affiliated attack group 'WaterPlum'
1.1. Overview
On September 18, 2026, the National Police Agency and the National Cyber Office, together with relevant authorities from the United States, Australia, and Germany, issued a warning about malicious cyber activities conducted by North Korea.*[1] Among these, detailed methods were revealed regarding attacks by the cyberattack group "WaterPlum" and foreign currency acquisition activities by North Korean IT workers through disguised employment.※[2] Additionally, for the first time, a case of crackdown on the 'Laptop Farm' was reported as a reality of its activities in Japan. This article is based on publicly available information, including the NTT Security Japan blog.
1.2. Public Attribution (Identification and Disclosure of Attack Actors)
Chief Cabinet Secretary Kihara referred to the recent warning jointly implemented by the four countries at a press conference on September 18. This warning is significant in that it reveals that North Korea is the main perpetrator behind the series of cyberattacks and disguised employment practices. Publicly identifying the attacker is expected to lead to international law enforcement and sanctions, as well as increased vigilance against private companies.
The Chief Cabinet Secretary expressed his recognition that malicious cyber activities pose a threat not only to Japan but to the security and economic activities of the entire world, and called on IT professionals and private businesses to implement appropriate security measures.
Figure 1: Press conference by Chief Cabinet Secretary Kihara (right)
Regarding this matter, Prime Minister Takaichi, who is visiting North America, also mentioned this on his X account, expressing his intention to strengthen cooperation with the international community in the field of cybersecurity.
1.3. WaterPlum Cyberattack
WaterPlum (also known as Famous Chollima or PurpleBravo) is a cyberattack group linked to North Korea. Attacks aimed at making money have been carried out against financial institutions, cryptocurrency (cryptocurrency) operators, and FinTech companies worldwide, with attacks confirmed in Japan as well. Within this group, there are multiple teams, each developing and using their own malware. These malware have been continuously improved, with expanded capabilities for attacks, such as credential theft and remote control of infected devices.
[Malware Infection from Disguised Recruitment Interviews]
Since around 2022, the group has been continuously conducting an attack campaign called "Contagious Interview," disguised as recruitment activities, and recently has also used a tactic called "ClickFake Interview". The flow of each attack is as follows:
① Contagious Interview
The group impersonates recruiters and places ads on job platforms to reach their target software developers. After contact, the applicant is guided to an online interview, where during the interview they request software reviews or analyses to download and run unauthorized programs, thereby infecting the device with malware.
Figure 3: Flow of Contagious Interview Attacks
② ClickFake Interview
The group guides job seekers to recruitment interview sites impersonating crypto-related companies.*[11] After having job seekers perform procedures similar to regular interviews, a method called "ClickFix" is used, where a camera malfunction is pretended during the interview and a command is executed on a computer as a solution. When job seekers follow on-screen instructions, malicious programs are actually downloaded and executed, infecting them with malware.
Figure 4: ClickFake Interview attack flow
These attacks steal cryptocurrencies and credentials from job seekers' devices.*[2] If such credentials are misused to infiltrate the network of a job seeker's current workplace, it can lead to intellectual property theft and harm not only to individuals but also to organizations.
1.4. Disguised Employment by North Korean IT Workers
North Korea disguises IT workers and employs foreign companies as remote workers to earn foreign currency ※[2].
Supporting these disguised employment practices are the "domestic enablers." Supporters provide North Korean IT workers with identification and bank accounts, install multiple PCs at home that these workers can remotely operate, and also offer internet connections. A group of PCs installed in this way is called a "laptop farm."
North Korean IT workers operate laptop farm PCs via VPNs and other means, disguising their actual locations and work locations, and use provided identification to pose as supporters and accept work orders. Additionally, bank accounts in names other than the applicant (such as supporters) are used as the recipients for receiving rewards.
In this public attribution, the National Police Agency revealed that, for the first time in Japan, a laptop farm run by supporters was confirmed, investigated, and dismantled.
1.5. Points of Connection Between the Two Activities and Damage Situation
WaterPlum and some North Korean IT workers operate under the command of the 313th General Bureau of the Munitions Industry Department of the Central Committee of the Workers' Party of Korea. Furthermore, it has been confirmed that the same IP address was used in the WaterPlum cyberattack using fake interviews and the fake employment of North Korean IT workers.
Malware infections have been confirmed on over 30,000 devices in over 100 countries and regions, including Japan, and more than 7,000 crypto wallet data has been stolen. At least approximately 1.7 billion yen worth of crypto assets were transferred to the crypto asset wallets managed by the group.
1.6. Summary
This public attribution not only made it clear to the international community that North Korea was the main actor in this series of activities, but also revealed that cyberattacks through malware infections and fake employment by North Korean IT workers are interconnected as organized fundraising activities. When a company orders North Korean IT workers for work, payment of compensation may lead to North Korea's foreign currency earnings, and there is also a risk of violating domestic laws and sanctions against North Korea. Therefore, it is important to view the risks of North Korean cyberattacks and the risks of involvement in the country's activities through recruitment and outsourcing as integrated threats, and to implement countermeasures not only in the IT department but also across the entire organization, including those involved in human resource management.
[1]
Source: National Police Agency, 'Public Attribution by Japan, the United States, Australia, and Germany Regarding North Korean Cyberattack Group 'WaterPlum' and North Korean IT Workers'
[2] Source: National Cyber Headquarters, National Police Agency, 'Cyberattacks Targeting IT Technicians by North Korean Cyberattack Group 'WaterPlum' and Actual Activities of North Korean IT Workers in Japan, the United States, and Europe' (National Police Agency)
[3] Source: NTT Security Japan, 'Threat Research Related to WaterPlum'https://jp.security.ntt/insights_resources/tech_blog/waterplum/
[4] Source: Prime Minister's Office, 'Friday, September 18, 2026 (Afternoon)'https://www.kantei.go.jp/jp/tyoukanpress/202609/18_p.html
[5] Source: X '@takaichi_sanae'https://x.com/takaichi_sanae/status/2100829294343942464
[6] Source: NTT Security Japan 'Adding Features to OtterCookie Malware Used by WaterPlum'https://jp.security.ntt/insights_resources/tech_blog/waterplum-ottercookie/
[7] Source: NTT Security Japan 'About the New Malware OtterCookie Used by Contagious Interview'
[8] Source: NTT Security Japan 'About OtterCandy, the malware used by WaterPlum https://jp.security.ntt/insights_resources/tech_blog/ottercandy_malware_j/
[9] Source: NTT Security Japan 'About the Malware StoatWaffle Used by WaterPlum' https://jp.security.ntt/insights_resources/tech_blog/stoatwaffle_malware/
[10] Source: Palo Alto Networks 'Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors' https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/
Source: Sekoia 'From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic'https://www.sekoia.com/blog/clickfake-interview-campaign-by-lazarus
U.S. Government Warns of Large-Scale AI Distillation Campaign by Chinese AI Companies
2.1. Overview
On September 8, 2026, three U.S. government agencies—CISA (Cybersecurity and Infrastructure Security Agency), NSA (National Security Agency), and FBI (Federal Bureau of Investigation)—jointly issued recommendations regarding large-scale AI distillation campaigns by Chinese AI companies. The U.S. government points out that Chinese AI companies are continuously and systematically extracting capabilities and functions from advanced American AI models, warning that this is not merely a commercial issue but a national security concern [12],[13].
2.2. What is distillation in AI?
In AI, "Knowledge Distillation" (*14) refers to a method that uses the output of high-performance AI models (teacher models) to train smaller AI models (student models). This approach allows efficient development of new models that operate with fewer computational resources and inference costs while inheriting the knowledge and reasoning capabilities of earlier high-performance models. In particular, recent cutting-edge models come with significant costs due to high-performance GPUs (computational processing units) and large-scale computing infrastructures, making distillation a key technology supporting the efficiency of AI development.
Figure 6 Conceptual diagram of distillation *[14]
Distillation itself is a legitimate technique, and it is generally accepted to use models developed or licensed by the company as instructor models. On the other hand, conducting a large number of inquiries about AI models developed by other companies and extracting capabilities and functions from responses to train their own models is being viewed as problematic from the perspectives of intellectual property and fair competition. Therefore, many commercial AI services prohibit or restrict the development of competing AI models or the use of models that lead to model duplication in their terms of service [15],[16].
2.3. Distillation Campaign by Chinese AI Companies and U.S. Government Warnings
According to joint recommendations from the U.S. government, Chinese AI companies have been conducting large-scale distillation campaigns for the most advanced U.S. AI models since the latter half of 2024. The advisory points out that Chinese AI companies such as DeepSeek, Moonshot AI, and Alibaba have been heavily inquiring about AI models provided by U.S. firms like Claude, GPT, and Gemini, and using the responses to improve the performance of their own models.
This distillation campaign was conducted by collecting responses worth billions of tokens (units of text processed by generative AI) through millions of inquiries, and was industrial-scale far beyond personal or research use. Additionally, it was found to utilize multiple channels such as native APIs (direct access to AI models), cloud services, and third-party AI aggregators (platforms that allow multiple different AI models to be used from a single interface), as well as methods to bypass geographic restrictions and monitoring using proxy services. The U.S. government has raised concerns not only about these activities violating terms of use, but also about the fact that they were continuously conducted without being detected, and has also mentioned the possibility that such activities were carried out under the Chinese government's awareness.
Concerns about distillation activities by Chinese AI companies are not being raised for the first time. Since early 2026, U.S. AI companies and threat intelligence organizations have reported large-scale distillation activities and model extraction attempts by Chinese AI firms, which have long been recognized as significant risks in the AI industry*[17],[18],[19]. This joint recommendation can be seen as an official response by the U.S. government to industry concerns.
Against this backdrop, the U.S. government warns that Chinese AI companies are leveraging the capabilities and features of cutting-edge AI models from American firms through distillation campaigns without fully bearing the costs required for research and development and computing resources. Furthermore, the decline of U.S. dominance in AI technology could affect future competitiveness in the economy, security, and cyber sectors, raising national security concerns.
In response to these risks, the U.S. government recommends that AI service providers strengthen monitoring of abnormal usage patterns, detect large-scale automated access, and enhance analysis of user accounts and access sources. It also mentions reducing the effectiveness of distillation by adjusting response content and controlling access to users suspected of distillation.
2.4. Summary
This recommendation indicates that measures against distillation that extracts AI model capabilities and functions have come to be recognized as a national security challenge beyond the framework of corporate intellectual property protection. He also revealed that competition over AI technology is expanding beyond securing semiconductors and computing resources to areas such as protecting and controlling the use of trained models.
In addition to these changes in competition, trends surrounding AI regulations, export controls, and security policies are also evolving daily. Even within the U.S., opinions are divided among AI companies and policymakers who prioritize accelerating development, while those who prioritize safety and regulation remain uncertain. Since these developments could have a significant impact on the future cybersecurity field, it is desirable for general companies to continuously monitor changes not only in AI technology but also in institutional aspects.
[12] Source: CISA 'China-Based Artificial Intelligence Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. AI COMPANIES' https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-251a
[13] Source: National Security Agency/Central Security Service 'NSA and Others Warn China-Based AI Companies are Distilling U.S. Frontier AI Models' https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4592113/nsa-and-others-warn-china-based-ai-companies-are-distilling-us-frontier-ai-mode/
[14] Source: NVIDIA Technical Blog 'New Foundational Models and Training Capabilities with NVIDIA TAO 5.5' https://developer.nvidia.com/blog/new-foundational-models-and-training-capabilities-with-nvidia-tao-5-5/
[15] Source: Anthropic 'Consumer Terms of Service'https://www.anthropic.com/legal/consumer-terms
[16] Source: OpenAI 'Terms of Use'https://openai.com/policies/terms-of-use
[17] Source: Anthropic 'Detecting and preventing distillation attacks' https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks
[18] Source: OpenAI 'Re: Updated Stakes for American-Led, Democratic AI' https://cdn.openai.com/pdf/045aa967-ee96-4a09-94ee-3098ddf6db2c/OpenAI-US-House-Select-Cmte-Update-[021226].pdf
[19] Source: Google Cloud Blog 'GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use' https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use
[20] Source: CNN Politics 'Trump officials considering AI executive meeting on the sidelines of Xi visit next week' https://edition.cnn.com/2026/09/16/politics/ai-executives-trump-xi-visit
Unauthorized access to the Digital Agency Government Solution Service
3.1. Overview
In September 2026, the Digital Agency announced that unauthorized access to the Government Solution Service (GSS), the government's common infrastructure, may have caused some files containing personal information to be leaked. There are approximately 246,000 pieces of personal information that may have been affected. GSS is a system that integrates business PCs and network environments that were individually operated by each ministry and agency. On June 25, the agency detected a large number of files accessed by maintenance personnel's accounts, and when the agency launched an investigation, it was discovered on July 9 that a third party had exploited vulnerabilities in VPN devices to infiltrate the system. The agency stated that it suspended the account and cut off communication between the compromised device and the outside world, thereby preventing subsequent unauthorized access.[21]
3.2. Exploited Vulnerabilities and Incident Background
The Digital Agency has not disclosed the name of the abused VPN product or vulnerability information (such as CVE number), but based on published materials and reports, it is speculated that it is related to the vulnerability 'CVE-2026-0257' contained in Palo Alto Networks' VPN products.*[22] If this vulnerability is exploited, it could bypass authentication and establish unauthorized VPN connections.※[23] Table 1 shows the main development from the disclosure of the vulnerability to the publication of the incident.
Period Events
May 13 Palo Alto Networks releases CVE-2026-0257 (CVSSv4:4.7)
May 17 Rapid7 Observes Actual Exploitation of Vulnerabilities
Around late May Attackers begin intrusion into GSS
May 29 Palo Alto Networks changes vulnerability severity to CVSSv4:7.8
June 25 Digital Agency detects access to a large volume of files
July 9 Digital Agency investigation revealed that this case was a system intrusion via VPN vulnerability.
September 11 Digital Agency Announces Proposal
Period | Events |
May 13 | Palo Alto Networks releases CVE-2026-0257 (CVSSv4:4.7) |
May 17 | Rapid7 Observes Actual Exploitation of Vulnerabilities |
Around late May | Attackers begin intrusion into GSS |
May 29 | Palo Alto Networks changes vulnerability severity to CVSSv4:7.8 |
June 25 | Digital Agency detects access to a large volume of files |
July 9 | Digital Agency investigation revealed that this case was a system intrusion via VPN vulnerability. |
September 11 | Digital Agency Announces Proposal |
Table 1: Main Background from Vulnerability Disclosure to Case Disclosure (Areas in red are related to the Digital Agency case)
The vulnerability was initially rated 4.7 (Medium) on CVSSv4 (a severity assessment metric), but was revised to 7.8 (High) on May 29.[24],[25].
Unauthorized access to the Digital Agency began around late May*[26], and was detected on June 25. The incident was made public on September 11, about three and a half months after the attack began. According to a press conference held by then-Digital Minister Hisashi Matsumoto on the same day, the Digital Agency was aware of known vulnerabilities in the exploited VPN products before the incident occurred, but did not recognize them as urgent vulnerabilities. As a result, while prioritizing other vulnerabilities, the attack was hacked.*[27]
Personal Information That May Have Been Leaked
According to the Digital Agency's announcement, the breakdown of approximately 246,000 pieces of personal information that may have been leaked is as follows.
Information on employees of GSS-using organizations and public servants engaged in their duties (including employees of independent administrative agencies): approximately 189,000 entries
Information on businesses and individuals engaged in GSS service providers: approximately 57,000 records
These included names, email addresses, phone numbers, addresses, and so on.
3.3. Challenges in Information Disclosure
There remain challenges in the disclosure of information in this case, both in terms of the specificity of the content and the timing of the announcement. Since the Digital Agency does not disclose the names of the abused VPN products and CVE numbers, other organizations find it difficult to determine whether there is an impact on their own organization or what measures are needed.
On the other hand, it takes about two and a half months from detection to public announcement of abnormalities. In the unauthorized access case against KDDI that occurred in June 2026, the Ministry of Internal Affairs and Communications issued administrative guidance to the company, alleging that passwords and other information for 7.62 million people were leaked. At that time, the Ministry of Internal Affairs and Communications pointed out that it took 22 days from receiving the initial report from ISP to publicly disclosing the case, stating that "it cannot be called a swift response." Given this administrative guidance to KDDI, it is necessary to examine the Digital Agency's information disclosure from the perspective of consistency with the standards required of private businesses by government agencies, including specificity and speed.
3.4. Risks Associated with GSS Infringement
The fact that attackers successfully exploited vulnerabilities in VPN devices to infiltrate GSS indicates that the impact extends beyond a single organization to multiple user organizations (such as government ministries). Additionally, personal information that may have been leaked is at risk of being misused for targeted attacks, supply chain attacks, and espionage activities. Given these points, the impact of this incident must also be closely monitored from the perspective of national security.
3.5. Summary
Although GSS was established based on the concept of Zero Trust, this case highlights that implementing Zero Trust itself does not guarantee safety, and that continuous operational improvements and strengthening monitoring and detection systems are essential to enhance its effectiveness. Furthermore, this case highlighted many challenges, including the importance of vulnerability management, the widespread impact of breaches on common infrastructure, and the need for specificity and speed in information disclosure.
[21] Source: Digital Agency, 'Possible Leakage of Personal Information of Staff Due to Unauthorized Access to Government Solution Services'https://www.digital.go.jp/news/2026-0911-01
[22] Source: piyolog 'A summary of unauthorized access to the Digital Agency's Government Solution Service (GSS)' https://piyolog.hatenadiary.jp/entry/2026/09/11/220855
[23] Source: NIST 'CVE-2026-0257 Detail'https://nvd.nist.gov/vuln/detail/cve-2026-0257
[24] Source: Palo Alto Networks 'CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities'https://security.paloaltonetworks.com/CVE-2026-0257
[25] Source: Arctic Wolf 'CVE-2026-0257: PAN-OS GlobalProtect Authentication Bypass'
[26] Source: Nikkei Crosstech, 'Unauthorized Intrusion into Government Agencies' Work Environment GSS, Risk of 246,000 Leaks Including Employee Names'https://xtech.nikkei.com/atcl/nxt/news/24/03383/
[27] Source: Digital Agency, 'Minister Matsumoto Press Conference (September 11, 2026)'
[28] Source: Ministry of Internal Affairs and Communications, 'Measures for Thorough Protection of Communications Secrets (Guidance)' https://www.soumu.go.jp/main_content/001083931.pdf
Disclaimer
Please note that while we do our best to ensure that the content of this article is accurate, we do not guarantee the content and do not compensate for any damages or losses incurred as a result of the use of this article. If you have any inquiries such as typographical errors, content errors, or other points in the article, please contact us at the following address.
Inquiries
NTT Security Japan Corporation
Professional Services OSINT Monitoring Team
