Tokyo, Oct. 4 (Jiji Press)–The Japanese government plans to bolster efforts in cooperation with the private sector in fiscal 2027 to probe whether attackers have infiltrated and remained hidden in systems of critical infrastructure operators such as power utilities and telecommunications companies. The government will develop methods to detect cyberattacks based on information regarding threats and share them with private-sector firms, in order to prevent possible crises caused by infrastructure shutdowns during a contingency. Threat hunting, or searching for hidden threats in systems, is one of the methods of active cyberdefense, related legislation for which took effect on Thursday. The government’s National Cybersecurity Office will use specific information on possible threats to recreate attacks in a virtual environment and develop and test threat detection methods that can be used by the private sector. The Defense Ministry will also provide direct assistance, including dispatching personnel to critical infrastructure operators at their request, drawing on its threat-hunting capabilities developed through the Self-Defense Forces’ information systems. The NCO and the Defense Ministry included related expenses in their budget requests for fiscal 2027. Such efforts come amid concerns that disruptions to privately operated critical infrastructure could lead to a national crisis in the event of a contingency. U.S. authorities estimated in 2024 that Volt Typhoon, a hacker group believed to be sponsored by the Chinese government, had maintained access to some U.S. critical infrastructure for more than five years. The group apparently exploited legitimate administrative tools to evade detection and remained hidden so that it could halt infrastructure functions during a contingency. Meanwhile, accumulating and analyzing the logs needed for threat hunting requires manpower and incurs costs. NTT Data Japan Corp. has conducted threat hunting in its in-house systems since 2024. It searches logs for suspicious activity even when there are no warnings, based on the assumption that a specific attack could be underway, to address possible hidden threats. “To expand this activity, we need to demonstrate its cost-effectiveness to management,” Yusuke Nakajima, a company official in charge of the threat hunting program, said. An NCO official said that preparing only for attacks involving hidden threats is unlikely to persuade company executives to invest in such measures. The official pointed out that threat hunting can also help tackle ransomware, a more familiar threat to companies, as it employs similar tactics such as probing systems after gaining entry. END [Copyright The Jiji Press, Ltd.]
