window.dataLayer = window.dataLayer || []; function gtag(){dataLayer.push(arguments);} gtag('js', new Date()); gtag('config', 'G-NMNT7YMYEV');


At Nihon Cyber Defence (NCD) we see the impact that cyber-attacks and in particular ransomware attacks can have. Whilst it has been major ransomware attacks that have dominated the headlines, the reality is that an enormous range of organisations are being impacted.

This increase in the number and sophistication of attacks has been driven by Ransomware as a Service (RaaS), that has made sophisticated cyber tools available to a growing range of criminal groups.

Dealing with a major cyber incident

For an organisation’s senior management, a ransomware attack is a major test of leadership. At NCD we believe that is important that senior managers, who are often under immense pressure, are supported through an incident. We have therefore – at the suggestion of several organisations that we have helped – are launching a cyber security advice service.

The key elements of this service are that it is:

  • Confidential
  • Cost effective
  • Provides access to world-class cyber security experts
  • For anyone in a leadership position


The sole purpose of the NCD Advice Service is to help you recover from a Cyber Attack


The way that this service works is:

  • Companies that believe that they may have become the victim of a cyber-attack, contact NCD through our online portal (please do not use an email address that may have been compromised in the attack).
  • A Non-Disclosure Agreement (NDA) is quickly put in place to ensure complete confidentiality.
  • After an initial discussion with a native Japanese speaker, a secure video conferencing call will be set up between the company’s management and world-class cyber security experts who have dealt with many hundreds of cyber security incidents. This call can be in English or with Japanese translation.
  • During the call senior managers CEO’s, CIOs, CFO’s, CISO’s or anyone else who finds themselves in a cyber incident management leadership role will have the opportunity to ask questions of these experts. These can be general questions around best and poor practice or specific technical questions.

Asking the right questions

For senior managers who do not have a technical background we will equip you with the questions to ask of your Incident Response team. They could include:

  • Technical Understanding – How did the incident happen? Has the access and attack vector been identified and closed? Is the attacker off the network or still there? Is there still a risk of further attack
  • Mitigation – What is the damage? What data has been affected or exfiltrated. How do we deal and mitigate this?
  • Attribution and Investigation – Who was behind the attack? Why was the victim targeted? Is there an option to pay? Will we negotiate to identify the data exfoliated or to delay exposure? Do we know where the exposure will be … can we disrupt this? Can we recover the encrypted data? Should you involve law enforcement?
  • Regulatory– What action is required from the data protection authorities or financial regulatory authorities?
  • Comms – What is the internal and external Comms plan? Will this be protective or reactive (pending exposure)? How will we inform affected data subjects?
  • Resilience – What is the plan to rebuild our network securely and how can we re-establish customer confidence and commercial reputation?
  • Governance – What advice and guidance should be made available to the Board during an incident? How should the Incident be managed?
  • Support – What external support do you require? As importantly, what support do we not require? How do we manage the expense of this support?
  • Engagement with the hostile actors. Should we engage? What are the risks associated with paying the ransom? How should engagement be taken forward?

Whilst this is designed to be a one-off service, many of our clients have found our experts’ advice to be invaluable and ask us to remain engaged acting as a critical friend or to provide specialist technical services through the attack.

Other services

This service is in addition to our existing incident management response consultancy framework which covers:
  • Preparation– boards awareness, incident planning and exercising 
  • Monitoring – developing the deployment of the technical solutions pre and post in a cyber incident
We also provide a highly confidential service for organisations who believe that they may have been the victims of an attack involving an insider.


Our customers tell us that, having won the work, the major consulting companies use primarily junior staff to carry out the work. At NCD we only use consultants with many decades of experience.

Latest Ransomware News!!

Heavy Industry

FBI releases joint advisory warning of Bl00dy ransomware targets education organisation in PaperCut attacks

On Thursday 11th of May 2023, the United States Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) released a joint TLP:CLEAR cybersecurity advisory warning organisation that the Bl00dy Ransomware gang is now actively exploiting a PaperCut remote-code execution vulnerability (CVE-2023-27350) to gain initial access to networks. The advisory revealed that the Bl00dy Ransomware Gang attempted

Read More »
Heavy Industry

Kroll reveals new Cactus ransomware that encrypts itself to evade antivirus

On Wednesday 10th of May 2023, Kroll revealed a new ransomware strain named ‘Cactus’ which has been exploiting vulnerabilities in VPN appliances for initial access to networks of large commercial entities since March 2023. The publication covering the strain revealed that the unique feature of the strain is its self-encryption capability. to make it difficult for antivirus software to detect

Read More »
Heavy Industry

Ransomware attack against Constellation Software claimed by ALPHV ransomware gang

On the 4th of May 2023, Constellation Software confirmed that some of its systems were breached by threat actors who also stole personal information and business data. However, they added that the incident did not impact the independent IT systems of Constellation Software’s operating groups and businesses. Constellation Software has stated that it had contained the incident and has now

Read More »
Heavy Industry

Avos ransomware gang hijacks university alert system to issue threats

On Sunday 30th of April 2023, Bluefield University disclosed that the university had suffered a cyberattack that impacted the IT systems, causing all examinations to be postponed. However, at that time it had claimed that its investigation had found no evidence of any cases of financial fraud or identity theft linked to the incident. Although on Monday 1st of May

Read More »

Cl0p ransomware attack impacts 783k Brightline patients

This week, Brightline, a pediatric mental health provider released a data notice warning patients that it suffered a data breach impacting 783,606 people following a cyberattack by the Cl0p ransomware gang. It is believed that the ransomware gang used a zero-day vulnerability (CVE-2023-0669) in its Fortra GoAnywhere MFT secure file-sharing platform to steal the data from 130 organisations including Brightline.

Read More »
Heavy Industry

Black Basta claims responsibility for a cyberattack against Yellow Pages Group

Last week, the Black Basta ransomware gang claimed responsibility for a cyberattack against the Yellow Pages Group, a Canadian directory publisher and posted a sample of sensitive documents and data. The posted sample included the following documents: ID documents (such as scans of passports and driver’s licenses) exposing people’s date of birth and address. Tax documents—exposing Social Insurance Number (SIN) Sales and

Read More »