Threat reportSupply ChainTL-2026-4065
Onamae Desktop Cloud (GMO Internet, Japan) infrastructure compromised; malware installed on up to 26,739 customer servers
Onamae Desktop Cloud (GMO Internet, Japan) infrastructure (TL-2026-4065), also tracked as Onamae.com Desktop Cloud incident, is a high-severity supply-chain compromise, first published 2026-10-21 and last reviewed 2026-10-24. It has no confirmed attribution, affects GMO Internet Onamae.com Desktop Cloud (Desktop Cloud byGMO), maps to 5 MITRE ATT&CK techniques (T1005, T1199, T1552), and is covered by 9 detection rules and 16 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 16Indicators of compromise
Key facts for TL-2026-4065
- Threat ID
- TL-2026-4065
- Also known as
- Onamae.com Desktop Cloud incident, Desktop Cloud byGMO compromise
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, technology
- Target regions
- japan
- Detection rules
- 9
- Indicators of compromise
- 16
- Updates
- 2026-10-24 · 2 updates · revalidated 2× · latest source
Malware and tooling in Onamae Desktop Cloud (GMO Internet, Japan) infrastructure
Malware and tooling: MetaTrader 4
How Onamae Desktop Cloud (GMO Internet, Japan) infrastructure works
Unauthorized third parties accessed GMO Internet's Onamae.com Desktop Cloud (a VPS service widely used for FX automated trading) and installed malicious programs in customer server environments, potentially affecting 26,739 servers across all plans. The provider confirmed the malicious programs on 2026-10-20 and began shutting servers down sequentially at 04:00 JST on 2026-10-21, with no restart date announced.
On 2026-10-21 GMO Internet (operator of the Onamae.com domain registrar and hosting brand) announced that its Desktop Cloud service (Desktop Cloud byGMO) had suffered unauthorized access by a third party. The provider discovered on 2026-10-20 that malicious programs had been installed on servers in customer environments. The number of servers potentially affected is 26,739, and all Desktop Cloud plans are included.
The official notice states that information stored on the servers may have been viewed. At the time of announcement GMO had not confirmed leakage of personal information or misuse of any viewed information. Payment card and settlement data are not retained by the company on these servers and payment information is reported as stored separately and unaffected.
Containment: GMO began shutting down affected servers sequentially at 04:00 on 2026-10-21 (all plans stopped). Forensic analysis is ongoing and the restart timeline will be announced after the investigation. Customers who store or use authentication credentials (IDs, passwords) inside their servers were asked to change them promptly, including identical passwords reused elsewhere, and to beware of phishing that exploits the incident. GMO states it will never ask for passwords or card information by email or phone.
The Desktop Cloud service is a remotely operated Windows-style VPS marketed for running automated FX trading tools such as MetaTrader 4, so servers may hold trading-platform credentials, broker account access and EA/automation tooling. Initial access vector, malware family, command-and-control infrastructure, indicators of compromise and threat actor attribution have NOT been disclosed by the provider or press as of 2026-10-21. Because the intrusion apparently occurred at the provider/infrastructure layer and propagated to many tenant servers, it is classified as a supply-chain (hosting provider) compromise. MITRE mappings in this record are inferred from the described behavior (provider-level access, program installation, stored-information access, credential-rotation guidance, anticipated phishing) and should be treated as low-granularity until technical details are published.
MITRE ATT&CK techniques used in TL-2026-4065
Collection
Initial Access
T1199 Trusted Relationship; T1566 Phishing
Credential Access
Impact
Affected products and versions in Onamae Desktop Cloud (GMO Internet, Japan) infrastructure
- GMO Internet — Onamae.com Desktop Cloud (Desktop Cloud byGMO)
Vulnerable versions: All Desktop Cloud plans (up to 26,739 servers potentially affected)
Remediation for Onamae Desktop Cloud (GMO Internet, Japan) infrastructure
Immediate actions
- Change any authentication credentials (IDs, passwords) stored or used inside Desktop Cloud servers
- Change identical passwords reused on other services
- Rotate API keys, broker/trading-platform and exchange credentials that were present on affected servers
- Treat any data stored on affected servers as potentially viewed
- Be alert to phishing referencing the incident; GMO never requests passwords or card data by email or phone
Workarounds
- Wait for GMO's restart announcement following forensic analysis; contact the provider via https://help.onamae.com/contact/ (03-5456-2560, weekdays 10:00-18:00 JST)
Longer-term hardening
- Do not store long-lived credentials on shared VPS images; use secret managers and least-privilege broker API keys
- Rebuild affected servers from clean images rather than resuming them once the provider allows restart
- Monitor broker/trading accounts for anomalous logins and orders
Timeline of Onamae Desktop Cloud (GMO Internet, Japan) infrastructure
- GMO Internet begins investigating Onamae.com Desktop Cloud following a customer inquiry.
- GMO announces emergency maintenance at about 18:30 JST, initially planned to run until noon on 2026-10-21.
- GMO Internet confirms malicious programs installed on Onamae.com Desktop Cloud customer servers following unauthorized third-party access
- GMO begins receiving user reports of unauthorized operations on trading accounts tied to tools used on the servers.
- At 03:48 JST the maintenance schedule is revised and the restart date becomes indefinite, ahead of the 04:00 JST sequential shutdown of all plans.
- No restart date announced; forensic analysis ongoing and restart timeline to be published after investigation
- BleepingComputer, ASCII.jp, ITmedia, INTERNET Watch and others report the incident; no attacker, malware family or IOCs disclosed
- GMO urges customers to change credentials stored on servers and identical passwords reused elsewhere, and to beware of phishing; support contact via help.onamae.com/contact/ and 03-5456-2560
- Provider states no leakage of personal information or misuse of viewed information confirmed so far; payment card data not held by GMO on these servers
- GMO Internet publishes official notice (onamae.com/news/article/11584): up to 26,739 servers potentially affected, stored information may have been viewed, customers told to change stored credentials
- At 04:00 JST GMO begins sequentially shutting down Desktop Cloud servers; all plans stopped
- OANDA Japan warns customers that MT4/MT5 trading credentials on affected servers may be exposed.
- GMO publishes the second report at 16:59 JST: 26,739 servers potentially affected, police consulted, investigation ongoing with an external cybersecurity firm; restart date undetermined.
- Security press (cybersecuritynews.com and others) continues to report no malware name, vector, actor or IOCs disclosed and no restoration date announced.
- Japanese press (Impress Watch) reports FX account credentials were stolen and unauthorized transactions occurred; servers remain offline with no restart date.
Update history for TL-2026-4065
- 2026-10-24 — Malware Planted on Onamae.com Desktop Cloud Servers (GMO Internet) - 26,739 Systems Potentially Affected, FX Trading Credentials Abused: What changed Impact escalated from possible information viewing to reported misuse: users report unauthorized operations on MT4/MT5 trading accounts since 2026-10-21. Motivation UNKNOWN - FINANCIAL. Severity, exploitability and status are l
- 2026-10-22 — Malware Planted on Onamae.com Desktop Cloud (GMO Internet) Servers Forces Japanese Provider to Shut Down FX-Trading VPS Service: What changed No change to severity (HIGH), exploitability (ACTIVE), status (ACTIVE) or attribution. Additive context only: the pre-shutdown maintenance sequence and added MetaTrader 5 scope. New indicators (1) 1 benign tool-context entry (M
Sources cited for Onamae Desktop Cloud (GMO Internet, Japan) infrastructure
- Japan's Onamae Desktop Cloud hacked, up to 27,000 servers affected
- Onamae.com official notice: unauthorized access to Desktop Cloud (GMO Internet)
- 「お名前.com デスクトップクラウド」不正プログラム設置で全プラン停止 FX用VPS、2万6739サーバに影響か (ITmedia NEWS)
- FX自動売買専用VPS「お名前.com デスクトップクラウド」、不正アクセス受けサーバー停止 (INTERNET Watch)
- お名前.comのFX自動売買VPSに不正アクセス 2万6739件のサーバーに影響の可能性 全プラン順次停止 (livedoor News)
- GMO「お名前.com デスクトップクラウド」全プラン停止 約2万7000件に影響の可能性 (ASCII.jp)
- お名前.com「デスクトップクラウド」に不正アクセス、最大2万6,739サーバーに影響の可能性 (Security Measures Lab)
- GMO「お名前.com デスクトップクラウド」全プラン停止 (Yahoo!ニュース / ASCII)
Detection coverage for TL-2026-4065
As of 2026-10-24, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4065 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.