Onamae.com Desktop Cloud breach: timeline and ransom demands

The breach of Onamae.com Desktop Cloud, GMO Internet’s VPS for automated FX trading, started with a report that malicious programs had been placed on it. It grew into unauthorized operation of trading accounts, a demand for money from the attacker, and the publication of material claimed to be user information. On November 1, Kyodo News reported that GMO has concluded North Korea-linked hackers are likely behind the attack.

GMO Internet is a Japanese internet infrastructure company, and Onamae.com is its domain and hosting brand. GMO has issued sixteen reports so far, and on November 2 it held its first press conference. This post lays out what became known when, using GMO’s disclosures and press coverage. The attacker side’s claims, and press reports about who the attacker is, are not GMO disclosures, so I keep them separate.

What kind of service was targeted#

Desktop Cloud is a VPS that rents out a Windows desktop environment. Users run the trading tools of FX and securities brokers (such as MT4/MT5) on the VPS around the clock for automated trading. Those tools store trading account login details, so anyone who gets into the VPS may also gain the ability to operate the account.

According to the second report (Japanese), 26,739 servers across all plans may be affected. The third report (Japanese) adds that this is the number of servers that could be affected, not the number where unauthorized access or data theft was confirmed. GMO says payment information, including credit cards, is not stored on these servers.

Timeline#

Times are Japan Standard Time. Where the source is not a GMO disclosure, it is noted in parentheses.

Date and time	Event
August 5	The attacker breaks into a user’s remote desktop and steals an administrator account (per the November 2 press conference; Jiji Press)
August 17	Using the stolen administrator privileges, the attacker gets into GMO’s management server (same)
September 20 to October 14	Malware is distributed through the management server (same)
October 19	GMO starts investigating after a customer inquiry
October 20	Malicious programs confirmed on some servers. New sign-ups and the control panel are suspended
October 21, 4:00	Servers on all plans are shut down in turn. The first report says no misuse has been confirmed
October 21	A threatening email arrives from someone believed to be the attacker, demanding $50 million (about 8 billion yen) in crypto assets by 5 p.m. on the 21st (deadline per Nikkei)
October 21 onward	Users report operations on their trading accounts that they did not make
October 22	GMO consults the police. The second report at 16:59 says saved login details may have been stolen and misused
October 23, 16:10	Third report. Warns that even after a password change, depending on the FX broker’s design, an existing session may remain and a third party may keep trading
October 24, 11:50	Fourth report. Confirms a security problem in the system and that information was taken outside. Announces a goodwill payment, compensation and a replacement service, and says it will not meet the demands. Asks the government to apply active cyber defense
October 24	The attacker side announces on its own site that it will not attack users if paid $1 million by noon on the 27th (Nikkei, FNN)
October 24, 15:00	Fifth report. Asks users to run a full scan on their devices and back them up
October 25	CEO Masatoshi Kumagai publishes a blog post. GMO asks users to cooperate in examining their devices (background in the seventh report)
October 26	Kumagai updates the blog post, disclosing the $50 million demand and the amount section of the threatening message
October 26, 23:10	Seventh report. Says the group’s white-hat hackers are analyzing users’ devices that GMO has received
October 27, 12:00	The deadline set by the attacker side. The seventh report says the attacker threatened to publish users’ information and launch ransomware attacks at this time
October 27, 12:30	GMO confirms that someone believed to be the attacker has published material claimed to be GMO’s and users’ information. As of 13:55, no ransomware attack has been confirmed (tenth report)
October 27, 19:10	Twelfth report. Announces a special goodwill payment for users whose information was published, and a bounty capped at a total of $1 million
October 28, around 4:00	GMO confirms the domain of the attacker’s site has been taken down (thirteenth report)
October 28, 12:00	GMO starts accepting tips for the bounty. 113 arrive by 18:00 (fourteenth report)
October 29	The Tokyo Metropolitan Police Department sets up an investigation headquarters of about 70 people (Asahi Shimbun). GMO says it will give the police and others information it believes could identify the culprits (fifteenth report)
November 1	Kyodo News reports that GMO has concluded North Korea-linked hackers are likely involved
November 2	Kumagai and other executives hold their first press conference. They explain when the intrusion happened, and that countermeasures for issues flagged in 2024 fell short

When the intrusion happened, as explained at the press conference#

The path in the table from August 5 to October 14 is what GMO Internet Vice President Hiroshi Yamashita explained at the November 2 press conference (Jiji Press’s detailed report, Japanese). GMO noticed on October 20, when it investigated after a customer inquiry. It did not reveal the detailed method, saying that doing so could invite similar attacks.

Group company GMO Cybersecurity by Ierae reported points to improve on April 24, 2024, and GMO Internet carried out four emergency maintenance windows from April 26 to May 20, but it says the countermeasures were not enough. According to the Asahi Shimbun (Japanese), that report never reached Kumagai. Yamashita said the countermeasures fell short because of “a judgment made within development priorities.” The Asahi Shimbun also reports that the details of the intrusion path are not yet known, so it is unclear whether the issues flagged in 2024 are the same as the path used this time.

North Korea-linked involvement is still at the press-report stage#

On November 1, Kyodo News (Japanese) reported, citing people familiar with the matter, that GMO has concluded North Korea-linked hackers are likely on the attacking side. The judgment appears to be based on multiple traces left by the attacker, such as characteristics of the malware, and GMO apparently reported it to the government.

The press reports cite two kinds of evidence. One is characteristics such as communication logs to the attacked service, which GMO is said to have confirmed. The other is an analysis Kyodo News did with help from security professionals: of the IP addresses that connected to the attacker’s “claim of responsibility” site right after it went up, five matched addresses North Korean hacker groups have used in the past.

GMO has neither officially confirmed nor denied this view. Asked at the press conference about possible North Korean involvement, Kumagai said, “We will analyze the data and report to the appropriate authorities. It is under investigation, so I cannot comment” (Nikkei, Japanese). Before the press conference, a GMO executive told JNN that the company is investigating, including the possibility of North Korean involvement. Responding to experts who called the methods crude, the executive suggested the attacker “may be deliberately making itself look less skilled” (TBS NEWS DIG, Japanese).

Security Measures Lab (Japanese) points out that researchers, journalists, and automated crawlers can also connect to the claim site, and that IP addresses can be used by other people through VPNs or cloud services. So those who connected to the claim site are not necessarily the ones who broke into GMO. Neither the malware samples nor the matching method have been published, so this cannot be verified from outside.

The demands have been reported with two amounts#

According to the fourth report, the attacker demanded money and said that if it was not paid, it would:

1. Keep placing unauthorized orders on accounts at more than 70 securities and FX brokers in Japan and abroad
2. Publish information from the VPS and from users’ PCs that connected to it, and launch ransomware attacks
3. Publish information about GMO’s systems and operations

The one GMO disclosed is the $50 million in the threatening email of the 21st. The amount first came out in an October 26 update to Kumagai’s blog post (Japanese). The “$1 million by noon on the 27th” reported by NHK and others is what the attacker side announced on its own site on the 24th, and Nikkei (Japanese) also reports it as a demand from a different time.

GMO says it will not pay. Paying would not guarantee that the stolen information is deleted or that misuse stops. The fourth report also warns that the attacker may publish material it claims is GMO’s or users’ information, and that it may contain false content.

On the deadline, the 27th, the attacker side published what it says is user information. According to the Asahi Shimbun, GMO confirmed only one person’s data in what was published. GMO has had no contact with the attacker side since the night of the 23rd. The eleventh report (Japanese) warns that the attacker obtains information about anyone who connects to the publishing site, and asks people not to open the site or spread it. The site’s domain was taken down around 4 a.m. on the 28th.

In the twelfth report (Japanese), GMO said it will “never” meet the demands, and set up a bounty capped at a total of $1 million (about 150 million yen) for information that leads to identifying those involved and solving the case. In the six hours after it started accepting tips at 12:00 on the 28th, 113 came in, and about 700 by the day of the press conference.

Why users’ own PCs are a concern#

The second threat targets the PCs users have at hand. GMO has not disclosed how the connection would be used, but the sixth report (Japanese) asks for a full scan, not a quick scan, of devices that connected to the VPS.

Users connect to the service with Windows Remote Desktop (RDP) (service site, Japanese). RDP has a feature that makes the drives of the local PC available on the remote side. According to Microsoft Learn, setting drivestoredirect:s:* in the connection settings redirects all drives, including ones connected later. The default is not to redirect. My own reading is that if a user connected with this enabled, local files could be visible from the server side once the server was taken over. GMO’s disclosures do not say whether this feature was the path in this case.

As of the fourteenth report (Japanese), analysis of the devices GMO received has found no traces of malware infection or ransomware attacks. On the other hand, GMO Internet President Tadashi Ito said at the press conference that GMO had also confirmed that data and other information were stolen from users’ PCs on the 27th (Jiji Press).

Compensation and the replacement service#

The fourth report sets out three measures.

• Every current user receives a flat 5,000 yen goodwill payment, whether or not they were harmed. A notice will arrive by email by 23:59 on October 30
• The compromised platform will not be restarted as is. Users who want to can switch to a replacement service on an independent cloud platform, free for six months. No one is migrated without consent
• Realized losses on accounts from unauthorized trades (trading losses, fees and so on) are compensated. Losses from market moves and lost profits are not covered. Amounts refunded by exchanges and others are deducted, and GMO pays even if they do not refund. How to apply will be announced by November 6

The ninth and twelfth reports later added two more.

• Users hit by ransomware will receive a new PC of equivalent performance after GMO checks the damage
• Users whose information GMO confirms is in the material the attacker published receive a special goodwill payment: 10,000 yen for name, contact details and similar; 15,000 yen for trading account IDs, passwords and similar; and 25,000 yen for sensitive personal information (what Japanese law calls “special care-required personal information”) and similar. When several categories apply, the amounts are added up (capped at 3 million yen). This is paid separately from the goodwill payment and loss compensation in the fourth report

The amount of compensation for losses from unauthorized trades is still being tallied, and GMO says it will disclose the impact on its earnings once the tally progresses (Asahi Shimbun).

The fourth report says the compensation application may ask for things like the MT4/MT5 read-only password. GMO will not ask for any other password or PIN, so any contact asking for them in the name of compensation or refunds is not from GMO.

The request for active cyber defense#

In the fourth report, GMO asked the government to make this the “first case” of active cyber defense. Japan’s provisions that let the police or Self-Defense Forces neutralize servers used for attacks took effect only on October 1. According to CNET Japan (Japanese), whether to carry it out is decided by the government, separately from any company’s request, and as a rule prior approval from an independent body is also required.

What is still unknown#

• The detailed method of intrusion. The press conference explained the timing and the general flow, but not how the attacker got into the user’s remote desktop
• Who the attacker is. The Tokyo Metropolitan Police Department’s investigation headquarters is looking into possible violations of the Unauthorized Computer Access Act and other charges
• How many accounts actually suffered unauthorized trades, and how much was lost. Press reports include a user who said they lost more than 4 million yen in 2 seconds, and a user who said they lost about 1.82 million yen
• What was taken from users’ PCs. At the press conference GMO said it had confirmed data was stolen, but it has not disclosed the scope

What users should do now#

Here are GMO’s requests from the third through sixth reports and the eleventh report, in order of priority. Do these from a separate device that has not connected to the VPS, and open the official sites directly.

1. Change the passwords for your trading accounts and trading tools
2. Disconnect all sessions from your FX broker’s member page or support desk. Changing the password alone may leave existing connections in place
3. Check your trading history and balance, and contact the broker if you see trades you did not make
4. Turn on two-factor authentication, and change passwords for other services that use the same password and any passwords saved in your browser
5. Run a full scan on devices that connected to the VPS, and back up important data to media disconnected from the network
6. Do not open the site where the attacker claims to have published information. If you already opened it, run a full scan on that device

GMO urges users not to open URLs or files, and not to reply, if they receive email from anyone claiming to be the attacker.