Japan launches cyber threat-hunting program for critical infrastructure

Japan's government is preparing to hunt for cyberattacks that have already breached the systems of power companies and telecommunications firms—the kind of intrusions designed to hide for months or years before striking. Starting in fiscal 2027, the National Cybersecurity Office will develop methods to detect these dormant threats and hand the blueprints to private operators so they can search their own networks before attackers activate whatever access they've gained.

The push reflects a specific fear: that hostile actors, particularly state-sponsored groups, could infiltrate critical infrastructure and simply wait. In 2024, U.S. authorities documented exactly this scenario with a hacker group called Volt Typhoon, believed to be backed by the Chinese government, which had maintained access to American critical infrastructure for more than five years. The group used legitimate administrative tools to blend in, making detection nearly impossible through conventional means. The longer such access persists undetected, the greater the potential for catastrophic disruption—power grids down, communications severed, a nation's essential services compromised during a crisis.

Threat hunting, as the practice is known, represents a shift in defensive thinking. Rather than waiting for alarms to sound, security teams actively search through system logs and network activity for signs of compromise, assuming an attacker may already be inside. The Japanese government's National Cybersecurity Office will recreate suspected attacks in controlled virtual environments, then develop and test detection methods that private companies can deploy. The Defense Ministry will contribute its own expertise, drawn from threat-hunting work done within the Self-Defense Forces' information systems, and will dispatch personnel directly to critical infrastructure operators who request assistance.

Both agencies have included funding for these efforts in their fiscal 2027 budget requests. The timing aligns with new legislation on active cyberdefense that took effect this week, giving the government a legal framework to pursue more aggressive security postures.

But threat hunting is labor-intensive and expensive. NTT Data Japan, one of the country's largest technology companies, began conducting threat-hunting within its own systems in 2024. The work means searching through logs for suspicious patterns even when no alarm has been triggered, based on the premise that an attack could be underway undetected. Yusuke Nakajima, the company official overseeing the program, acknowledged the central challenge: convincing executives that the investment is worth the cost. "To expand this activity, we need to demonstrate its cost-effectiveness to management," he said.

A National Cybersecurity Office official noted that companies are unlikely to fund threat-hunting if they think of it only as protection against hidden, long-term infiltrations—a threat that feels abstract compared to ransomware, which strikes visibly and demands immediate payment. Yet threat-hunting can address ransomware too, since attackers often use similar tactics: they probe systems after gaining entry, looking for valuable data or critical functions to encrypt. By framing threat-hunting as a tool that defends against multiple attack types, the government hopes to make the case for private investment more compelling. The real test will be whether utilities and telecom companies, once they have the detection methods in hand, actually use them.