# GMO Internet Onamae Desktop Cloud breach and extortion: 26,739 VPS servers exposed, MetaTrader credentials stolen, customers urged to shut down PCs over ransomware threat

> An unidentified actor compromised GMO Internet's Onamae Desktop Cloud VPS service (discovered 2026-10-20), exposing up to 26,739 customer servers, stealing customer data and MetaTrader 4/5 trading credentials, and demanding a ransom of about 8 billion yen (~$50 million). GMO refused to pay; the actor published data online on 2026-10-27 and threatened pre-planted ransomware, though no ransomware was reported to have activated.

- **Published:** 2026-10-28T00:05:04Z
- **Last reviewed:** 2026-10-28T05:47:24.213Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4580
- **ID:** TL-2026-4580
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

GMO Internet Group's Onamae Desktop Cloud is a VPS / virtual-desktop service widely used by retail FX traders to run MetaTrader 4/5 automated trading. GMO began investigating after customer inquiries on 2026-10-19 and confirmed unauthorized programs on customer server environments on 2026-10-20. New applications and control-panel access were suspended, and all servers were halted at about 04:00 JST on 2026-10-21. GMO notified police on 2026-10-22. Its 4th official report (2026-10-24) confirmed that customer information was taken externally and that customers of more than 70 securities/FX firms reported unauthorized trades. Official notices state the service had security-related issues that allowed unauthorized access, but the intrusion vector and malware type have not been disclosed. Up to 26,739 servers are potentially affected.

The actor emailed GMO a ransom demand of about 8 billion yen (~$50 million, reported as payable in Bitcoin or Ether) around 2026-10-21, with a deadline reported as noon JST on 2026-10-27. One Japanese source reports a revised demand of about $1 million (~150-160 million yen) on 2026-10-24. GMO refused all demands. On 2026-10-26 GMO warned that the actor planned to leak data and trigger ransomware payloads. On 2026-10-27 GMO confirmed that data tied to the company and its customers had been posted online and urged customers to disconnect and power down PCs. BleepingComputer notes the attacker appears never to have acted on the ransomware threat, as nothing was activated on customer machines. GMO says payment information was not exposed. MetaTrader 4/5 credentials and trading account details were exposed, and individual trading losses of roughly 550,000 to 6 million yen per case were reported.

Single-source, unconfirmed claims (an ITmedia analyst blog fact pack, not GMO) should be treated as medium/low confidence. They describe: shared administrative credentials and an Active Directory misconfiguration spanning customer VPS environments; abuse of default-enabled RDP drive redirection in distributed .rdp profiles to reach customers' local PCs, steal browser-cached passwords and contact lists and plant backdoors; about 140,000 MT4/MT5 credential sets; a malicious Expert Advisor named DEMOFASTLOSS that forced high-frequency losing trades; a leak site on coronamng.store (registered 2026-08-31 via Namecheap) with a track.php beacon that logs visitor IPs; and a claimed persona 'Dmitry Orlov' that the blog assesses is not genuinely Russian. TechCrunch reported that CrowdStrike linked earlier attacks on South Korean banks to the Chinese AI pentest tool Artex, but GMO has not publicly connected Artex to this incident, so no attribution is made. GMO is working with Trend Micro on recovery, offers a 5,000 yen goodwill payment per user, reimbursement of verified unauthorized-trading losses and six months of free replacement service, and has asked the Japanese government for 'active cyber defense' authority.

## MITRE ATT&CK

- T1583.001 Domains
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078.002 Domain Accounts
- T1021.001 Remote Desktop Protocol
- T1552.001 Credentials In Files
- T1555.003 Credentials from Web Browsers
- T1005 Data from Local System
- T1657 Financial Theft

## Sources

- [Japan's GMO urges customers to shut down PCs amid ransomware threat](https://www.bleepingcomputer.com/news/security/japans-gmo-urges-customers-to-shut-down-pcs-amid-ransomware-threat/)
- [Japan internet giant GMO says hackers posted stolen customer data](https://techcrunch.com/2026/10/27/japan-internet-giant-gmo-says-hackers-posted-stolen-customer-data/)
- [Onamae.com official notice: Desktop Cloud cyber attack (4th report)](https://www.onamae.com/news/article/11598)
- [Impress Watch: GMO Onamae.com Desktop Cloud security incident](https://www.watch.impress.co.jp/docs/news/2150663.html)
- [GMO unauthorized access in a nutshell: demand timeline and stock impact (note.com)](https://note.com/wata_pixelart/n/nf82bd1dd726a)
- [GMO refuses $50 million ransom, will repay FX losses after server breach (BigGo Finance)](https://finance.biggo.com/news/b79624a0-b5ec-4c7d-bc8b-9dcb4f00ed22)
- [ITmedia: GMO Onamae.com Desktop Cloud double-extortion incident threat-intelligence fact pack (single-source analyst blog, unconfirmed)](https://blogs.itmedia.co.jp/serial/2026/10/_gmocom.html)
- [CrowdStrike: ARTEX AI and Claude agents used against South Korean banks (context only; no confirmed link to GMO)](https://www.bleepingcomputer.com/news/security/hacker-used-artex-ai-and-claude-agents-to-target-south-korean-banks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4580