5SEP

SiteGuard hit; Qilin posts Keio files

3 min read

12:09UTC

Attackers exploited a flaw in EG Secure Solutions' SiteGuard web firewall, prompting a JPCERT/CC emergency alert on 14 October. A day later Qilin posted files it says came from Tokyo rail group Keio Corporation.

← Back to Four privileged platforms under live attack Jump to analysis ↓

TechnologyDeveloping

Key takeaway

A security product became the entry point in Japan, while Qilin kept posting Japanese victims' files.

EG Secure Solutions confirmed on 14 October that attackers were exploiting CVE-2026-106931, a flaw in its SiteGuard Server Edition web application firewall (software that screens traffic to a website) that lets an attacker run any command with full administrator rights. Japan's national computer emergency response team, JPCERT/CC, issued emergency alert AT-2026-0032 the same day⁠¹. Operators are told to save diagnostic data before updating, because the update may erase traces of the attack. When JPCERT/CC warned on a NetScaler flaw in August, it reported no sign of attacks; here the vendor itself confirmed exploitation. CISA listed it on 20 October, the vendor's first entry in the US exploited-flaw catalogue.

Qilin, a ransomware-as-a-service crew, posted 71 claims on its leak site in the first three weeks of October, on ransomware.live's count⁠². Among them, on 15 October, were files from Keio Corporation, the Tokyo rail and property group: 27 images of contracts, internal email screens and personnel summaries⁠³. Keio confirmed the release on 16 October and is checking with outside experts whether the material is genuine. The company had disclosed a ransomware attack on 26 September that hit group sales systems and Keio Plaza Hotel servers but left trains running.

Japan's National Police Agency (NPA) counts 53 Qilin victims in Japan since April 2023 and about 4,000 worldwide⁠⁴. Kyodo reported that on 8 October Japan handed a 28-year-old Russian man, detained in Osaka in May, to German authorities investigating Qilin; it did not report his alleged role.

Deep Analysis

In plain English

SiteGuard is Japanese software that screens traffic before it reaches a website. Its maker confirmed on 14 October that attackers were using a flaw in it to take full control of servers. Japan's emergency response team told operators to save evidence before installing the fix. Separately, the ransomware gang Qilin posted what it says are files stolen from Keio, a Tokyo rail and property company. Keio is checking whether the files are real.

Deep Analysis

Root Causes

Web application firewalls run with the highest privileges on the servers they protect, so a command-injection flaw hands attackers administrator rights directly. Products sold mainly in one domestic market may draw less outside security research than global brands, which can leave flaws for attackers to find first.

Qilin runs as ransomware-as-a-service: affiliates rent its tools and choose their own victims. Its Japanese toll reflects many separate intrusions under one brand, not a single coordinated campaign.

What could happen next?

Risk
SiteGuard operators who patch without saving diagnostic data may lose the only record of whether attackers reached their servers.
Consequence
Keio faces further publication pressure while it checks whether the posted material is genuine.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The cPanel flaw in April also hit software that sits in front of web servers and runs with root rights, with exploitation running long before the emergency fix. A flaw in that layer hands over the box it was meant to guard.

Counter-parallel: JPCERT/CC's August NetScaler alert said it had no information on exploitation. With SiteGuard the vendor itself confirmed attacks on the day of disclosure, so JPCERT/CC went straight to an emergency alert.

Consensus view: JPCERT/CC's instruction to save diagnostic data before updating SiteGuard treats the patch itself as a threat to the evidence, so operators must trade speed against forensics. CISA's 20 October listing made SiteGuard the vendor's first KEV entry, carrying a Japanese domestic product onto the US federal patch list.

Counter-view: Japan's National Police Agency counts 53 Qilin victims in Japan since April 2023, which describes a steady national toll rather than a new campaign. The Keio posting continues an attack Keio disclosed on 26 September, so the fresh element is publication pressure, not a new intrusion.

Key tension: Whether the Keio files are genuine, which Keio is still checking with outside experts, and whether Qilin releases more.

Sources:ransomware.live·CISA·Kumamoto Nichinichi Shimbun (Kyodo)

Mentions:JPCERT/CC →Qilin →National Police Agency →CISA →Japan →Osaka →Tokyo →EG Secure Solutions →SiteGuard Server Edition →Keio Corporation →Keio Plaza Hotel →ransomware.live →

First Reported In

Update #15 · Fridge hack spoils food in seven countries

ransomware.live· 22 Oct 2026

Read original →

Causes and effects

Caused by

Ransomware crews' claims fall to 815

Qilin's 71 October claims follow its September fall to 74.

Occurred 30 Sept 2026

Read story →

This Event

SiteGuard hit; Qilin posts Keio files

Japan faced an exploited flaw in a domestic security product and a fresh Qilin leak in the same week, with police counting 53 Qilin victims in the country.

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.