Threat reportRansomwareTL-2026-4580
GMO Internet Onamae Desktop Cloud breach and extortion: 26,739 VPS servers exposed, MetaTrader credentials stolen, customers urged to shut down PCs over ransomware threat
GMO Internet Onamae Desktop Cloud breach and extortion (TL-2026-4580), also tracked as Onamae Desktop Cloud incident, is a high-severity ransomware operation, first published 2026-10-28. It has no confirmed attribution, affects GMO Internet Group Onamae.com Desktop Cloud (VPS / virtual desktop, maps to 9 MITRE ATT&CK techniques (T1005, T1021.001, T1078), and is covered by 9 detection rules and 13 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-4580
- Threat ID
- TL-2026-4580
- Also known as
- Onamae Desktop Cloud incident, GMO Internet unauthorized access incident
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, technology, cloud-hosting
- Target regions
- japan, Asia-Pacific
- Detection rules
- 9
- Indicators of compromise
- 13
- Updates
- 2026-10-28 · revalidated 1× · latest source
Malware and tooling in GMO Internet Onamae Desktop Cloud breach and extortion
Malware and tooling: DEMOFASTLOSS, Dataleak, ARTEX
How GMO Internet Onamae Desktop Cloud breach and extortion works
An unidentified actor compromised GMO Internet's Onamae Desktop Cloud VPS service (discovered 2026-10-20), exposing up to 26,739 customer servers, stealing customer data and MetaTrader 4/5 trading credentials, and demanding a ransom of about 8 billion yen (~$50 million). GMO refused to pay; the actor published data online on 2026-10-27 and threatened pre-planted ransomware, though no ransomware was reported to have activated.
GMO Internet Group's Onamae Desktop Cloud is a VPS / virtual-desktop service widely used by retail FX traders to run MetaTrader 4/5 automated trading. GMO began investigating after customer inquiries on 2026-10-19 and confirmed unauthorized programs on customer server environments on 2026-10-20. New applications and control-panel access were suspended, and all servers were halted at about 04:00 JST on 2026-10-21. GMO notified police on 2026-10-22. Its 4th official report (2026-10-24) confirmed that customer information was taken externally and that customers of more than 70 securities/FX firms reported unauthorized trades. Official notices state the service had security-related issues that allowed unauthorized access, but the intrusion vector and malware type have not been disclosed. Up to 26,739 servers are potentially affected.
The actor emailed GMO a ransom demand of about 8 billion yen (~$50 million, reported as payable in Bitcoin or Ether) around 2026-10-21, with a deadline reported as noon JST on 2026-10-27. One Japanese source reports a revised demand of about $1 million (~150-160 million yen) on 2026-10-24. GMO refused all demands. On 2026-10-26 GMO warned that the actor planned to leak data and trigger ransomware payloads. On 2026-10-27 GMO confirmed that data tied to the company and its customers had been posted online and urged customers to disconnect and power down PCs. BleepingComputer notes the attacker appears never to have acted on the ransomware threat, as nothing was activated on customer machines. GMO says payment information was not exposed. MetaTrader 4/5 credentials and trading account details were exposed, and individual trading losses of roughly 550,000 to 6 million yen per case were reported.
Single-source, unconfirmed claims (an ITmedia analyst blog fact pack, not GMO) should be treated as medium/low confidence. They describe: shared administrative credentials and an Active Directory misconfiguration spanning customer VPS environments; abuse of default-enabled RDP drive redirection in distributed .rdp profiles to reach customers' local PCs, steal browser-cached passwords and contact lists and plant backdoors; about 140,000 MT4/MT5 credential sets; a malicious Expert Advisor named DEMOFASTLOSS that forced high-frequency losing trades; a leak site on coronamng.store (registered 2026-08-31 via Namecheap) with a track.php beacon that logs visitor IPs; and a claimed persona 'Dmitry Orlov' that the blog assesses is not genuinely Russian. TechCrunch reported that CrowdStrike linked earlier attacks on South Korean banks to the Chinese AI pentest tool Artex, but GMO has not publicly connected Artex to this incident, so no attribution is made. GMO is working with Trend Micro on recovery, offers a 5,000 yen goodwill payment per user, reimbursement of verified unauthorized-trading losses and six months of free replacement service, and has asked the Japanese government for 'active cyber defense' authority.
MITRE ATT&CK techniques used in TL-2026-4580
Collection
Lateral Movement
T1021.001 Remote Desktop Protocol
Initial Access
T1078 Valid Accounts; T1190 Exploit Public-Facing Application
Privilege Escalation
Credential Access
T1552.001 Credentials In Files; T1555.003 Credentials from Web Browsers
Resource Development
Impact
Affected products and versions in GMO Internet Onamae Desktop Cloud breach and extortion
- GMO Internet Group — Onamae.com Desktop Cloud (VPS / virtual desktop service)
Vulnerable versions: All service tiers; up to 26,739 servers potentially affected - MetaQuotes — MetaTrader 4 / MetaTrader 5 (credentials and trading accounts on affected VPS)
Vulnerable versions: Instances hosted on affected Onamae Desktop Cloud servers
Remediation for GMO Internet Onamae Desktop Cloud breach and extortion
Patches
- No CVE or vendor patch published; service-side fixes are being applied by GMO
Immediate actions
- Follow GMO guidance: disconnect, power down and unplug PCs that connected to Onamae Desktop Cloud until cleared
- Change VPS, remote-desktop and MetaTrader/broker passwords from a clean device and terminate active broker sessions
- Enable two-factor authentication on broker and trading accounts
- Review trading history for unauthorized trades and report to broker; file loss claim with GMO per its published procedure
- Treat unsolicited contact referencing the breach or offering litigation help as potential fraud; rely on official GMO channels
Workarounds
- Do not reconnect to Onamae Desktop Cloud until GMO confirms restoration
- Use the free six-month replacement service only after verifying it is delivered via official GMO channels
Longer-term hardening
- Disable RDP drive/clipboard redirection by default in .rdp profiles used for remote trading desktops
- Segregate trading VPS credentials from personal and email credentials; use unique passwords and a password manager
- Hunt for persistence and unknown executables or Expert Advisors on endpoints that connected to the affected service
- Prepare offline backups and tested restore for endpoints that connected to affected servers
Timeline of GMO Internet Onamae Desktop Cloud breach and extortion
- Domain coronamng.store (later the data leak site) registered via Namecheap, per a single-source ITmedia analyst blog; unconfirmed by GMO.
- GMO begins investigating after customer inquiries about Onamae Desktop Cloud.
- GMO confirms unauthorized programs on customer server environments; emergency maintenance, new applications and control-panel access suspended.
- All Onamae Desktop Cloud servers halted at about 04:00 JST; ransom email demanding about 8 billion yen (~$50 million) in Bitcoin or Ether reportedly received the same day.
- OANDA Japan notifies customers of exposure; customers begin receiving extortion emails signed 'Hacking Team' titled 'About the destruction of your Onamae.com Desktop Cloud account'.
- GMO notifies police and publicly announces the incident (26,739 servers); reports emerge of unauthorized trades in customers' FX and securities accounts.
- GMO 4th report confirms customer information was taken externally; announces 5,000 yen payment per user, reimbursement of verified trading losses and six months of free replacement service. A revised ~$1 million demand is reported by one Japanese source.
- GMO requests customer cooperation to collect devices for examination; Trend Micro and white-hat researchers offer assistance.
- GMO president Masatoshi Kumagai apologizes and requests that the government apply active cyber defense measures.
- GMO warns the actor plans to leak data and trigger ransomware payloads; GMO Internet shares fall about 17%.
- Suspected attacker posts data allegedly tied to GMO customers and business at about 12:30 JST; GMO confirms no ransomware activation by 13:55 JST. GMO states the Desktop Cloud service will not be restored and is being rebuilt on new infrastructure.
- Actor posts data tied to GMO and its customers online; GMO urges customers to shut down and unplug PCs and warns media against spreading the data. No ransomware reported activated.
Update history for TL-2026-4580
- 2026-10-28 — GMO Internet Onamae.com Desktop Cloud Breach: Malware on Up to 26,739 Customer Servers, MT4/MT5 Credential Theft, Unauthorized Trading and Ransomware/Data-Leak Extortion: What changed No severity/exploitability/status change (HIGH / ACTIVE / ACTIVE already). Added context: service will not be restored (rebuilt on new infrastructure), leak posted ~12:30 JST, no ransomware activation by 13:55 JST. New indicato
Sources cited for GMO Internet Onamae Desktop Cloud breach and extortion
- Japan's GMO urges customers to shut down PCs amid ransomware threat
- Japan internet giant GMO says hackers posted stolen customer data
- Onamae.com official notice: Desktop Cloud cyber attack (4th report)
- Impress Watch: GMO Onamae.com Desktop Cloud security incident
- GMO unauthorized access in a nutshell: demand timeline and stock impact (note.com)
- GMO refuses $50 million ransom, will repay FX losses after server breach (BigGo Finance)
- ITmedia: GMO Onamae.com Desktop Cloud double-extortion incident threat-intelligence fact pack (single-source analyst blog, unconfirmed)
- CrowdStrike: ARTEX AI and Claude agents used against South Korean banks (context only; no confirmed link to GMO)
Detection coverage for TL-2026-4580
As of 2026-10-28, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4580 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.