National Cybersecurity Office
Japan's central government cyber coordination office, set up in July 2025 to replace NISC.
Japan's National Cybersecurity Office put out the Japanese release of a ten-agency advisory naming Beijing's Integrity Technology Group on 9 October 2026, listing intrusion tools such as the SoftEther VPN client and indicators reaching back to January 2016.
Last refreshed: 12 October 2026
Who now runs Japan's cyber defence after NISC was reorganised?
Timeline for National Cybersecurity Office
Named as National Cybersecurity Office
Cybersecurity: Threats and Defences: Mentioned in: Ten agencies name Beijing firm in hacksBackground
The National Cybersecurity Office (NCO) sits at the centre of Japan's government cyber defence. Japan created it in July 2025 out of the National Center of Incident Readiness and Strategy for Cybersecurity (NISC), and the National Cyber Director heads it.
The NCO serves as secretariat to the Cybersecurity Strategic Headquarters. NCO staff watch for and analyse attacks on government systems, audit and advise ministries, and coordinate national cyber policy. It is also the government's computer emergency response TEAM, sharing that ground with JPCERT/CC, which handles private companies.
On 9 October 2026 the NCO and the National Police Agency jointly published Japan's version of the allied notice on Integrity Technology Group. Among the tools it listed was the SoftEther VPN client, with indicators of compromise dating from January 2016.
Japan signs on to allied attribution
On 8 October 2026 ten agencies from seven countries, Japan among them, named Integrity Technology Group, a for-profit Beijing company, as an enabler of Chinese government-linked intrusions matching the Flax Typhoon actor. The office's own contribution came a day later, when it and the National Police Agency issued the Japanese text on 9 October.
The Japanese release added detail of its own. It named a scanner called MicroScan, a Linux binary called office-cli and a commercial VPN client that the intruders installed with PowerShell so their access survived a reboot. Japan's police dated the activity to January 2016, and the release described password spraying against Microsoft Exchange Server. The office had existed for about 15 months when it put its name to the release.