Onamae.com Desktop Cloud breach puts FX logins at risk
The Onamae.com Desktop Cloud breach has put foreign exchange trading credentials at risk after malicious programs were found on some customer servers. The cloud-hosted service provides remote Windows desktops used for FX, meaning foreign exchange, trading. GMO Internet, the subsidiary operating the service, detected the programs on October 20 and shut down servers across every plan from October 21. It lists 26,739 servers as potentially affected, but that figure does not represent confirmed compromises or confirmed data theft.
On October 24, GMO said it had verified a security failure in the service, unauthorized access and the removal of customer information from company systems. Anything customers stored on their remote desktops may have been viewed, including credentials saved in MetaTrader 4 and 5 (MT4/MT5), widely used trading applications. Payment card information was not kept on those servers. The company had not disclosed the attackers' entry method as of October 28.
Customers began reporting trades they did not recognize on October 21. OANDA Japan confirmed that an unauthorized party had logged in to and traded through some customer accounts with ID and password combinations that the broker believes came from the breached servers. It restricted trading on accounts that might be affected. As of October 26, OANDA Japan had found no intrusion or information leak in its own core systems.
FXTF issued a related warning on October 22. It said credentials belonging to some customers who use virtual private servers, or VPS systems that provide remote computers hosted elsewhere, may have been stolen in an attack on another company's infrastructure. The credentials may then have been used to access accounts and place trades. FXTF advised customers who had connected through Desktop Cloud to change their passwords from a device that had never accessed the service.
The attackers demanded about $50 million, described as approximately 8 billion yen, on October 21. GMO refused to pay. According to the company, the group threatened to interfere with customer accounts at more than 70 securities and FX businesses, disclose service and customer PC information, deploy ransomware against customer computers and reveal details of GMO's systems. Ransomware is malicious software designed to make files or devices unusable, usually alongside a demand for payment.
A deadline of noon on October 27 was set for releasing customer information and beginning the ransomware attack. No ransomware deployment had been confirmed by 1:55 p.m. Japan time that day. The attackers did publish material that they described as one customer's personal information, ITmedia NEWS reported, although GMO was still checking it. The company said the attackers' website collected information about visitors and urged people not to open it, share its links or repost its contents. Its domain and mirror sites were taken offline at about 4 a.m. Japan time on October 28, and GMO said it would act against replacements. Anyone who visited was advised to run a full antivirus scan.
The attackers also claimed that one administrator account was shared across all servers, that customer PC drives were visible by default during connections and that a service flaw allowed access to customers' own computers, according to ITmedia NEWS. GMO had not confirmed those claims. The group's head separately acknowledged that internal white-hat hackers, security specialists authorized to find weaknesses, had warned the service team beforehand and said the response had not been sufficiently fast or thorough. By October 26, customer PCs had been collected for analysis. Among devices examined by 11:59 a.m. Japan time on October 27, investigators had found no malware, including ransomware, but testing remained in progress and did not establish that every device was safe.
GMO opened its GMO Cybercrime Bounty on October 28, offering up to $1 million in total for information that results in an arrest or an international wanted notice. Tips can be submitted anonymously in Japanese, English or Chinese. The program ends when an arrest or wanted notice occurs, or on October 27, 2027, whichever comes first. A single qualifying tipster could receive the entire amount, or the fund could be divided according to GMO's assessment of how much each submission contributed. Identity verification is required before payment, and no reward will be issued if no tip qualifies.
The program seeks evidence connecting people, servers, domains, IP addresses, online accounts or cryptocurrency addresses to the intrusion, extortion or movement of money. Unsupported allegations, guesses and republished public information generally do not qualify. Anyone involved in the crime, anyone who obtained information illegally, including by purchasing leaked data, and GMO employees are ineligible. Tipsters are explicitly told not to enter systems without permission, contact or pay the attackers, or submit credentials, leaked information or malware. Relevant information may be shared with authorities in Japan and abroad, while evidence and communications already held by GMO have been given to police. Genuine correspondence will come only from an address ending in @cybercrimebounty.gmo, and tipsters will not be asked for passwords, authentication codes or fees.
GMO has advised customers to change trading and trading-software passwords from a different device, close every active session, review balances and trading histories, and report unfamiliar activity to their broker first. Customers should enable two-factor authentication, which requires a second confirmation in addition to a password, where available. They should also replace reused passwords, scan connected devices, make backups and avoid messages, links or files claiming to come from the attackers. Offers to recover losses in exchange for a fee should be treated as fraudulent.
Every current user is due 5,000 yen. GMO also says it will cover actual losses and fees from trades it confirms were unauthorized and caused by the breach. Customers whose information is confirmed as published are due between 10,000 and 25,000 yen for each category of exposed information. As of October 28, the company had not established how many customers would receive payments, how much information had been published or which trades qualified. It had not identified an effect on its other services.
The breached systems will not be restarted in their existing form. Customers wanting another Windows desktop will be offered, with their consent, a move to a separate service at no charge for six months, with details due by October 30. For organisations reassessing remote systems and credential handling after incidents like this, AEU-I provides security-first IT, infrastructure and consulting.