Cyber Incident Victim: Fukuoka
Date:
Sep 2022
Location:
Japan
Summary
A Russia-affiliated hacking group known as Killmets claimed responsibility for cyber-attacks targeting multiple Japanese government ministry websites and companies, causing temporary inaccessibility and login disruptions to the e-Gov administrative portal. The incidents, attributed to Japan's support of Ukraine and territorial disputes with Russia, involved suspected denial-of-service (DDoS) tactics aimed at disrupting public services. Government systems were restored within a day, though investigations into the group's exact role remained ongoing. The attacks aligned with Killmets' pattern of disruptive operations against nations supporting Ukraine, following similar incidents in several European countries.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On September 6, 2022, multiple Japanese government websites experienced disruptions attributed to cyber-attacks. The Russia-affiliated hacking group Killmets claimed responsibility for targeting 20 websites across four Japanese government ministries and several companies. The attacks rendered sites intermittently inaccessible starting Tuesday evening, with Japan's Digital Agency confirming login difficulties to certain e-Gov administrative portal services the following day. Chief Cabinet Secretary Hirokazu Matsuno acknowledged investigating whether distributed denial-of-service (DDoS) attacks caused the outages, though he noted no definitive attribution to Killmets at the initial stage. Government technicians restored all affected websites by the end of Wednesday, September 7. Matsuno emphasized ongoing analysis of the technical failures and Killmets' potential involvement while confirming no reports of data breaches or permanent damage.
The incident coincided with heightened geopolitical tensions following Japan's support for Ukraine during the Russia-Ukraine conflict and historical disputes over the Kuril Islands. Threat intelligence analysts, including Check Point's Sergey Shykevich, assessed the attacks as consistent with Killmets' pattern of politically motivated DDoS operations targeting nations opposing Russian interests. Similar disruptions had previously impacted government infrastructure in Italy, Lithuania, Estonia, Poland, and Norway. The attacks temporarily hindered public access to critical online services but caused no confirmed data exfiltration or persistent system compromise. Japan's cybersecurity response focused on rapid service restoration and technical verification of attack vectors, with no publicized countermeasures or policy changes announced during the immediate aftermath.