GMO Internet, one of Japan's biggest domain registrars and hosting companies, took the unusual step this week of telling customers to unplug their computers. Attackers who broke into its Onamae.com Desktop Cloud service had announced a deadline of noon on October 27 (Japan time) to leak stolen data and set off ransomware, and GMO decided the safest move was to get as many machines offline as possible before the clock ran out.
What happened
Onamae.com Desktop Cloud is a virtual private server service run by GMO Internet, part of the GMO Internet Group. GMO says it detected an intrusion into the service on October 20. The company believes malware may have been placed on as many as 26,739 customer servers, so it shut servers down and limited the service while it investigated.
The situation escalated over the following days. According to GMO's updates, reported by BleepingComputer, the attackers stole data and demanded a ransom of ¥8 billion (roughly $50 million). GMO says it will not pay. On October 26, it warned that the attackers planned to publish customer information and trigger a ransomware payload they claimed to have planted earlier in the attack.
On the morning of October 27, GMO asked customers to run full antivirus scans, back up their data, then disconnect their PCs from the network, power them off and unplug the cables before noon. The company is working with Trend Micro on the response, and GMO staff have been collecting customer devices around Japan so the group's in-house security team can analyse them.
At 12:30 that day, GMO confirmed that the attackers had posted what they claim is company and customer data. GMO says it is still checking whether the material is genuine and warned that it may contain false information. As of its later reports, no ransomware attack had been confirmed, and the devices it had finished analysing showed no sign of malware or ransomware.
Who is affected
The incident affects users of Onamae.com Desktop Cloud, which is popular in Japan for running always-on software such as MetaTrader trading platforms. GMO says payment card details were not exposed, but it warned that MetaTrader 4 and MetaTrader 5 login credentials and trading account details may have been exposed or compromised.
GMO has said it will pay each customer ¥5,000 (about $30) for the disruption, and that it will consider additional compensation for customers whose information turns out to be in the leak. Customers hit by ransomware are being offered a replacement PC with equivalent performance.
Technical details
GMO has not publicly explained how the attackers got in, which malware was involved, or which group is behind the attack. No CVE has been linked to the incident. The key risk is that anyone with access to a hosting provider's management systems can push code to many customer servers at once, which is why GMO treated every affected server and connected PC as potentially compromised rather than waiting for confirmation.
What readers should do
- If you use Onamae.com Desktop Cloud, follow GMO's official incident page rather than links in emails or text messages. GMO says it will never ask for your password or authentication code.
- Change your MetaTrader 4 and MetaTrader 5 passwords, end any active trading sessions, and review your trading accounts for activity you don't recognise.
- Before reconnecting a PC that GMO asked you to unplug, back up your files and run a full security scan.
- Ignore any message offering to "recover your losses" for a fee, and be wary of calls, emails or texts that claim to come from GMO or a related organisation.
- Don't visit or share the leak site. GMO warns that the attackers collect information on visitors, and it is preparing legal action against people who spread the data.
For everyone else, this is a reminder that a breach at your hosting provider can become your incident too. Keep offline backups, use unique passwords and multi-factor authentication for anything running on rented servers, and have a plan for taking systems offline quickly.
Sources
- BleepingComputer: Japan's GMO urges customers to shut down PCs amid ransomware threat
- GMO Internet: Current Response to Unauthorized Access to "Onamae.com Desktop Cloud" (Eighth Report)
- GMO Internet: Current Response to Unauthorized Access to "Onamae.com Desktop Cloud" (Tenth Report)
- GMO Internet: Onamae.com Desktop Cloud unauthorized access update (14th Report, Japanese)
0 Comments