GMO Onamae.com Desktop Cloud - Customer Remote Desktop VPS → Administrator Account and Management Server → Malware Pushed to Customer Desktops → Saved Broker Logins and Redirected PC Drives → Unauthorized Trades and Extortion
GMO Internet, part of GMO Internet Group, ran Onamae.com Desktop Cloud, a hosted Windows desktop (VPS) service used for automated FX trading. On October 20, 2026, after a customer inquiry the day before, GMO confirmed that a third party had planted a malicious program in some customers' server environments, and from 04:00 JST on October 21 it shut down servers on every plan. At a November 2 press conference, as reported by ITmedia's @IT and other outlets, GMO set out the chain: entry through a customer's remote desktop VPS on August 5, an administrator account taken from there (on August 5 in some reports, on August 17 in @IT's), GMO's management server on August 17, and malware distributed through that server to customer virtual machines from September 20 to October 14. Broker logins saved on the desktops were used for unauthorized trades, and because Remote Desktop drive sharing was on by default, files on customers' own PCs were taken too. An extortion email and a leak site followed. Three caveats belong next to the headline. The figure of 26,739 is GMO's count of servers that may have been affected, not of confirmed unauthorized access. GMO has not said how the attacker got in or obtained the administrator account. And GMO has named no attacker or country.
Onamae.com Desktop Cloud rented out Windows virtual servers that customers reached over Remote Desktop and used to run FX trading tools such as MetaTrader 4 and 5. GMO dated the first intrusion to August 5 in the timeline it gave at its November 2 press conference, as reported by @IT, and placed it in a customer's remote desktop VPS. Hirofumi Yamashita, GMO Internet Group's executive vice president in charge of systems, withheld the method, citing the need to prevent similar attacks and the effect on the investigation.
The attacker claimed on its leak site to have exploited a Remote Desktop Protocol flaw, according to GovInfoSecurity, and GMO has not confirmed that. Asked at the press conference whether AI was used in the attack, group CEO Masatoshi Kumagai said there was no evidence that it was. The T1133 mapping describes the entry point, a remote desktop service exposed to customers, and is not a confirmed technique.
Entry point: a customer's remote desktop VPS
Method: withheld by GMO
Attacker's claim: a Remote Desktop Protocol flaw, unconfirmed
Reports of GMO's press conference timeline differ on when the administrator account was taken. ITmedia Business Online, Business+IT and MediaDogs say the attacker took it at the customer VPS on August 5 and got into GMO's management server on August 17. @IT's account dates the theft of the account to August 17, the same day as the management server intrusion. That server is the pivot of the chain: about five weeks later, the malware went out to customer machines through it.
GMO has not said how the account was obtained or what kind of account it was. The attacker's version, which GovInfoSecurity reported from the leak site, is that the VPS network ran as an Active Directory environment that let it move to other VPS servers, and that it intercepted an administrator password exposed when a support engineer connected remotely to a customer's PC. GMO has confirmed none of these claims.
Management server entered: August 17, 2026, in every report of GMO's timeline
Reached: an administrator account, then GMO's management server
How: not disclosed by GMO
Attacker's claims: Active Directory across the VPS network; an intercepted support password
The management server is how an intrusion that began in a customer VPS reached other customers' machines. In @IT's account of the press conference, GMO said the malware was distributed through the management server to up to 26,739 customer virtual machines. GMO's written notices use 26,739 as the number of servers that may have been affected, and say it is not the number of cases in which unauthorized access or information acquisition has been confirmed. GMO has not named the malware or said how the management server delivered it, so the T1072 mapping rests on its description of the server as the channel.
GMO did not notice for more than two months after August 17. Yamashita said the company's service monitoring had not caught the intrusion and that it would examine what was missing. A customer inquiry on October 19 started the investigation. On October 20 GMO confirmed the malicious program and suspended new sign-ups and the control panel, and from 04:00 JST on October 21 it shut down servers on every plan in sequence.
Channel: GMO's management server; mechanism not disclosed
Scale: up to 26,739 customer VMs (@IT); in GMO's notices, servers that may have been affected
Detected: October 20, after a customer inquiry on October 19
Containment: every plan shut down from 04:00 JST, October 21
GMO's second and third reports said a third party may have obtained trading account login information and other data stored on the servers, including logins saved in trading tools, and used it illegally. Its first report, on October 21, had said that no leak of customers' personal information and no misuse had been confirmed at that point. By the fourth report, on October 24, GMO had confirmed a security problem in the service's system, unauthorized access to its environment, and that customer information was taken outside the company.
In a notice to brokers that named neither GMO nor any broker, MetaQuotes, which develops MT4 and MT5, said neither the platforms nor the trading servers had been compromised, and that attackers had got into rented servers running trading terminals and traded with the logins saved there, according to Finance Magnates. GMO has not said how the logins were extracted or how data left its network. The T1555 mapping assumes they were read from the trading tools' saved credentials.
GMO's wording: may have been obtained and used (second and third reports)
Confirmed: customer information taken outside the company (fourth report)
Not compromised: MT4/MT5 platforms and trading servers, per MetaQuotes
Unknown: extraction method and exfiltration channel
When a customer connected, Remote Desktop drive redirection made the drives of that customer's own PC available inside the session on the infected virtual machine. At the press conference GMO named this default as the reason files on customers' local PCs were taken. According to @IT, Yamashita said the setting had been turned on for customer convenience, and that not switching it off as security risks grew was a lapse in risk analysis. Inside the remote session the redirected drives are reachable much like network shares, which is the basis for the T1039 mapping.
The attacker had made the drive redirection claim on its leak site before GMO confirmed it, and threatened a ransomware attack with a deadline of noon on October 27. GMO asked customers to back up, disconnect and power off their PCs before then, and collected PCs from customers who volunteered them for analysis. Its fourteenth report, on October 28, said analysis of those devices had found no traces of malware infection or ransomware attacks so far, and its ninth report had cautioned that results to date did not confirm the safety of every customer's device.
Effect: customers' local drives readable from the infected VM
Stated by GMO at the press conference (per @IT): files on customers' local PCs were taken; its written notices do not say so
Device analysis: no malware or ransomware traces on the PCs GMO examined (fourteenth report)
GMO's timeline records reports from October 21 of unauthorized operations on customers' trading accounts. @IT, reporting the press conference, says the attacker used the stolen account information on the same day as the extortion email to place trades that deliberately produced losses in FX accounts. Japan's Finance Minister Satsuki Katayama said five FX firms had reported affected customers, according to Bloomberg as cited by Finance Magnates. MetaQuotes' notice to brokers describes trades placed with logins saved on rented servers, and GMO's third report says trading account logins stored on its servers may have been obtained and used illegally, which is why this step maps to T1078. T1078 describes the logins; the losses themselves are the impact.
The extortion message threatened continued unauthorized orders against customer accounts at more than 70 securities and FX companies in Japan and abroad (fourth report). GMO asked major exchanges and securities firms to block access coming through the service, forcibly end all active sessions and watch for unauthorized trading. GMO says it will compensate realized losses on trades it confirms were unauthorized, less any refund from the broker, and it began contacting customers about claims on November 6.
FX firms reporting affected customers: 5, per Finance Minister Katayama
Threatened: 70+ securities and FX companies (fourth report)
GMO's request to brokers: block access through the service, end all sessions
Compensation: realized losses on trades GMO confirms as unauthorized
The extortion email arrived on October 21, the day GMO suspended the service. The demand, as reproduced on Kumagai's blog, asked for US$50 million in Bitcoin or Ether by 17:00 JST that day; GMO's notices give the amount as about ¥8 billion. The fourth report listed the threats: continued manipulation of trading accounts, publication of information about the service and the customer PCs connected to it along with ransomware attacks, and publication of information about GMO's systems. GMO said it would not pay, because paying would not guarantee that the data was deleted or that its misuse stopped. GovInfoSecurity reported that the extortionists later said they would settle for US$1 million, and IBTimes, citing NHK, reported that on October 27 GMO said it would not pay a US$1 million ransom either. GMO's own notices give an amount only for the October 21 demand.
At 12:30 JST on October 27 GMO confirmed that the attacker had published what it claimed was information about GMO and its customers, and @IT reports that one record of stolen data appeared. GMO warned that the site captured information about anyone who visited it. The site's domain was suspended at around 04:00 JST on October 28. Later that day GMO opened a bounty of its own, capped at US$1 million (about ¥150 million) in total, for information leading to the identification and arrest of those responsible. GMO states that the reward is neither a ransom nor a payment for stolen information; it is paid to people who supply information, and the attacker and accomplices are excluded. By November 6 it had received 852 tips.
Kyodo News reported that, according to unnamed sources speaking on November 1, an analysis by GMO found a North Korea-linked group likely responsible, based on traits of the malware and other traces. Kyodo, working with security experts, also found that five IP addresses that reached the claim-of-responsibility site soon after it went online matched addresses previously used by a North Korean group. Cybersecurity sources in the same report said the site carried traces linked to several countries, possibly a false flag. GMO's public notices attribute the attack to no one. Asked at the November 2 press conference about reports that a North Korea-linked group was likely involved, Kumagai said GMO had analyzed the affected servers and reported the data to the appropriate authorities, and that with the investigation under way he could not name a country or say anything else, according to Reuters.
GMO's position: will not pay
Leak: confirmed by GMO at 12:30 JST, October 27
Takedown: site domain suspended around 04:00 JST, October 28
GMO bounty: up to US$1 million for tips, separate from the demand
🛡 How to Defend Against This Chain
drivestoredirect:s: value turns it off in the connection files you hand out. If you connect to a desktop someone else runs, Microsoft documents a DisableDriveRedirection registry value that blocks redirection from your own Windows PC.