Japan's Keio Hit by Ransomware; Railway Resilient via Air-Gap

Executive Summary

Keio Corporation, one of Japan's premier private transit and hospitality conglomerates, has officially confirmed that its business systems were crippled by a targeted ransomware attack detected in the early morning hours of Saturday, September 26, 2026. The incident forced an emergency shutdown of the group's corporate network infrastructure, knocking critical commercial services offline across Tokyo.

The intrusion impacted core commercial subsidiaries: point-of-sale credit card processing and electronic money (e-money) transactions failed across group retail stores, loyalty point accruals were halted, Keio Bus commuter pass card services were disrupted, and hotel booking engines across 25 properties—including the flagship Keio Plaza Hotel and Keio Presso Inn—were rendered completely inaccessible.

Critically, train operations across Keio's 85-kilometer railway network and 69 stations continued to operate normally with zero passenger delays. This operational continuity was made possible because Keio's safety-critical railway signaling, Automatic Train Stop (ATS), and dispatch systems operate on a physically isolated, air-gapped Operational Technology (OT) network completely decoupled from corporate enterprise IT. The incident provides a masterclass case study in the efficacy of the Purdue Model and network segmentation under active ransomware conditions.

Technical Vulnerability Analysis & Attack Chain

Stage 1: Enterprise Perimeter Ingress

• Access Vector: Initial telemetry suggests the threat actor gained entry through an internet-facing corporate IT perimeter gateway—likely an unpatched remote access appliance (SSL VPN/VDI portal) or via harvested employee credentials.
• Foothold Establishment: Once inside the enterprise corporate network, the adversary established persistent command-and-control (C2) communications over encrypted outbound channels (HTTPS/DNS tunneling) to evade external perimeter inspection.
• Initial Reconnaissance: The actor targeted corporate Active Directory (AD) domains, focusing on mapping trust relationships between Keio Corporation and its multi-industry group subsidiaries.

Stage 2: Lateral Spread & Credential Dumping

• Identity Compromise: Adversaries conducted memory dumping of the Local Security Authority Subsystem Service (LSASS) on initial entry nodes, harvesting domain administrator credentials.
• Cross-Subsidiary Pivoting: Using privileged domain credentials, the threat actors traversed enterprise wide-area networks (WAN), moving laterally into server clusters supporting hotel property management systems (PMS), retail inventory infrastructure, and commercial billing gateways.
• Defense Impairment: Threat operators systematically tampered with endpoint detection agents and deleted Volume Shadow Copies (vssadmin delete shadows /all /quiet) to inhibit local system restoration.

Stage 3: Operational Technology Boundary Block (Air-Gap Defense)

• OT Traversal Attempt: Consistent with modern ransomware playbooks targeting critical infrastructure, the attackers scanned internal network subnets for industrial control systems (ICS) and supervisory control and data acquisition (SCADA) endpoints associated with railway dispatching.
• Purdue Model Validation: The traversal attempt failed completely at the boundary between enterprise IT (Purdue Levels 4/5) and the railway Industrial DMZ/Cell Zone (Purdue Levels 2/3). Keio's railway signaling systems, ATS controllers, trackside interlockings, and central train dispatch servers operate on physically separated copper/fiber lines with no routable IP paths to corporate enterprise servers.
• Transit Continuity: As a direct result of this architectural isolation, trains continued running on standard weekend timetables without a single cancellation.

Stage 4: Enterprise Server Encryption & Commercial Outages

In the pre-dawn hours of September 26, the ransomware payload detonated across group enterprise servers:

• Hospitality Disruption: Hotel property management systems at Keio Plaza Hotel and Keio Presso Inn were encrypted, forcing hotels to suspend new online reservations, disable automated guest check-ins, and handle inquiries manually.
• Retail Point-of-Sale Failure: Commercial payment gateways connecting retail store point-of-sale (POS) registers to acquiring banks were disrupted, leaving retail stores unable to process credit cards, e-money (Suica/Pasmo integrations), or issue digital loyalty rewards.
• Transit Commerce Interruption: Credit card payment processing for bus commuter passes at Keio Bus ticket counters was severed, creating administrative backlogs.

Stage 5: Emergency Network Severance & Digital Forensics

• Manual Network Disconnection: Upon confirming unauthorized encryption activity, Keio's cybersecurity response team executed an emergency manual severance, disconnecting corporate server clusters from the internet and isolating internal VLANs to prevent further spread.
• Law Enforcement & Incident Response: The incident was formally reported to the Tokyo Metropolitan Police Department. External cybersecurity incident response and forensic investigators were mobilized on-site.
• Data Leak Investigation: As of disclosure, Keio reported no confirmed external data exfiltration. However, forensic analysis of dark web leak repositories and staging directories remains ongoing to verify whether employee or customer personal data was exfiltrated prior to payload detonation.

MITRE ATT&CK Tactics, Techniques & Procedures (TTPs)

Threat Actor Profile & Campaign Attribution

Attribution Status: Unclaimed as of September 28, 2026.

Threat Landscape Context:

• Surge in Japanese Critical Infrastructure Targeting: Over the past 24 months, Japanese critical infrastructure and commercial conglomerates have been aggressively targeted by prominent ransomware cartels. Precedent incidents include the Nagoya Port container terminal ransomware attack (LockBit 3.0), the KADOKAWA publishing and streaming breach (BlackSuit), and attacks against Asahi Group and pharmaceutical manufacturers.
• Double-Extortion Playbook: Modern cartels operating in East Asia (such as LockBit, BlackSuit, Akira, and BianLian) systematically conduct data exfiltration prior to payload deployment, holding both system decryption and public data exposure over the victim's head.
• Targeting Multinationals via Subsidiaries: Threat actors specifically target diversified conglomerate holding companies because subsidiary networks (retail, hospitality, logistics) often maintain shared Active Directory trusts while having uneven security posture compared to core infrastructure.

Detection & SOC Mitigation Playbook

1. Patch & Workaround Guidance

• Edge Appliance Vulnerability Audit: Immediately scan and patch all external edge appliances, SSL VPN gateways (e.g., Citrix NetScaler, Ivanti Connect Secure, Fortinet FortiOS), and remote desktop gateways exposed to the internet.
• Enforce Purdue Architecture Segregation: Re-verify that all Operational Technology (OT), SCADA, signaling, and physical safety systems are completely air-gapped or separated via dual-firewalled Industrial DMZs (IDMZs). No direct routable IP communication should ever exist between corporate IT (Level 4/5) and control networks (Level 0–3).
• Isolate Payment and POS Processing: Architect payment card networks in strict compliance with PCI-DSS 4.0, ensuring retail point-of-sale registers and payment gateways operate in segmented VLANs that do not share authentication domains with general enterprise corporate IT.
• Immutable Offline Backups: Implement the 3-2-1-1-0 backup rule with at least one copy stored on immutable, physically air-gapped, or write-once-read-many (WORM) storage to withstand domain-wide encryption sprees.

2. Network & Perimeter Defenses

• Micro-Segmentation Across Group Subsidiaries: Terminate flat enterprise Active Directory forests. Implement cross-forest trusts with selective authentication rather than two-way transitive trusts between unrelated conglomerate subsidiaries (e.g., transit vs. retail vs. hospitality).
• Mandatory FIDO2 Multi-Factor Authentication: Enforce phishing-resistant MFA across all external access points, remote management tools, and privileged administrative sessions.
• Egress Filtering on Corporate Server Segments: Restrict outbound internet access from database and application servers to explicit whitelist destinations, preventing external C2 beacons and automated data exfiltration.

3. Endpoint Detection & Hunting Query

title: Bulk Volume Shadow Copy Deletion and Recovery Inhibition
id: 3f8a1c9e-5b2d-4e7a-9c6b-1d8f2e3a4b5c
status: stable
date: 2026/09/28
author: CyberNewsAI Threat Intelligence
description: Detects common command-line sequences used by ransomware operators to inhibit system recovery and delete volume shadow copies
references:
  - https://www.bleepingcomputer.com/news/security/japans-keio-confirms-ransomware-attack-disrupted-business-systems/
  - https://cybernewsai.com/blog/japans-keio-ransomware-attack-air-gapped-railway-resilience
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin:
    Image|endswith: '\vssadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'shadows'
  selection_wmic:
    Image|endswith: '\wmic.exe'
    CommandLine|contains|all:
      - 'shadowcopy'
      - 'delete'
  selection_bcedit:
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains|all:
      - 'set'
      - 'recoveryenabled'
      - 'no'
  selection_wbadmin:
    Image|endswith: '\wbadmin.exe'
    CommandLine|contains|all:
      - 'delete'
      - 'catalog'
  condition: selection_vssadmin or selection_wmic or selection_bcedit or selection_wbadmin
level: critical
tags:
  - attack.impact
  - attack.t1490
  - attack.defense_evasion
  - attack.t1562.001
falsepositives:
  - Legitimate automated system backup routines (rare for complete shadow deletion)

// Splunk SPL - Hunting for Cross-VLAN Lateral Movement and Mass Service Stoppage
// Detects administrative lateral movement tools and mass service modification preceding ransomware
index=windows sourcetype="WinEventLog:Security" EventCode=4688
| eval ProcessPath=lower(NewProcessName)
| where match(ProcessPath, "(psexec|paexec|psexesvc|wmiprvse|net1?\.exe|sc\.exe)")
| eval Command=lower(CommandLine)
| where match(Command, "(stop|delete|config|\/user:|c\$\s*\\|admin\$\s*\\)")
| stats count as execution_count, values(Command) as commands_run by ComputerName, SubjectUserName, bin(_time, 15m)
| where execution_count > 5
| sort - execution_count

Impacted Subsidiaries & Operational Entities

Incident Forensic Parameters