GMO Internet's Onamae.com Desktop Cloud breached: malware planted on customer VPS servers, up to 26,739 potentially affected, all plans suspended
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 23/10/2026 00:03; os links antigos trazem para cá.
Attackers gained unauthorized access to the infrastructure of Onamae.com Desktop Cloud, a VPS service run by GMO Internet in Japan, and installed "unauthorized programs" in some customers' server environments. GMO confirmed the intrusion on October 20, 2026 (bleepingcomputer.com, gbhackers.com). It began rolling shutdowns of all Desktop Cloud plans at 04:00 local time on October 21 (bleepingcomputer.com). It identified 26,739 potentially affected servers. Data on those servers may have been viewed, but GMO has not confirmed any leak of personal information or misuse of data. The service is widely used for automated forex trading with MetaTrader 4 (MT4). On October 22, OANDA Japan warned that MT4/MT5 login credentials hosted there may have been exposed (gbhackers.com). No restart date has been announced, and GMO says it will publish updates as the investigation continues.
Detalhes técnicos
- GMO's notice does not name the malware, the initial access vector, exploited vulnerabilities, persistence mechanisms or attacker infrastructure. No IOCs are published, and there is no attribution (bleepingcomputer.com, gbhackers.com).
- It is unclear whether a central management component, individual virtual servers or another part of the service was compromised (gbhackers.com).
- The malware type (ransomware, stealer or cryptominer) is not established (gbhackers.com).
- Payment data such as credit card details is reportedly stored on separate infrastructure and is unaffected (bleepingcomputer.com). GMO says it does not retain card data (gbhackers.com). gbhackers.com cautions that this does not show that data inside affected customer servers stayed inaccessible.
- Other Onamae.com services have not been announced as suspended (gbhackers.com).
- GMO warns of increased phishing and other unsolicited communications that exploit the incident (bleepingcomputer.com).
Remediação
- Change all passwords and other secrets stored on or used by Desktop Cloud servers as soon as possible, including any reused passwords on other services (bleepingcomputer.com, gbhackers.com).
- OANDA Japan customers should change My Page and MT4/MT5 passwords, enable two-factor authentication where available, review trading histories and report suspicious transactions to support (gbhackers.com).
- Treat emails or calls asking for passwords or card data as suspicious. GMO says it never requests them by email or phone (bleepingcomputer.com, gbhackers.com).
- Wait for GMO's further findings and its service resumption announcement.
Relatos divergentes
- Scope of 26,739: bleepingcomputer.com (Oct 21) says malware was installed on "up to" 26,739 customer servers. gbhackers.com (Oct 22, more recent) says the figure counts potentially affected servers, not verified infections or customers, and this is the safer reading.
- Data exposure: bleepingcomputer.com says data "may have been exposed". gbhackers.com says it "may have been viewed". Both say GMO has not confirmed misuse or leakage.
Linha do tempo
-
Malware planted on Onamae.com Desktop Cloud servers; 26,739 servers potentially affected, all plans suspended
ler a análise desta fonte ocultar
Attackers gained unauthorized access to Onamae.com Desktop Cloud, operated by GMO Internet, and installed malicious programs in some customer server environments. GMO confirmed the installations on October 20, 2026. On October 21 it began rolling shutdowns of all Desktop Cloud plans and identified 26,739 potentially affected servers. Information on those servers may have been viewed. Because Desktop Cloud is commonly used to run automated forex trading software, OANDA Japan warned on October 22 that MetaTrader 4/5 login credentials hosted there may have been exposed.
Technical Details
- The notice does not name the malware, initial access vector, exploited vulnerabilities, persistence mechanisms or attacker infrastructure, and it publishes no IOCs.
- It is unclear whether a central management component, individual virtual servers or another part of the service was compromised.
- The 26,739 figure counts potentially affected servers, not verified infections or customers.
- There is no attribution, and the malware type (ransomware, stealer or cryptominer) is not established.
- GMO says it has not confirmed leakage of customer personal information or misuse of viewed data, and that it does not retain payment card data. This does not show that data inside affected customer servers stayed inaccessible.
- Other Onamae.com services have not been announced as suspended.
Remediation
- Immediately change all credentials stored on or used by Desktop Cloud servers, and change any reused passwords on other services.
- OANDA Japan customers should change My Page and MT4/MT5 passwords, enable two-factor authentication where available, review trading histories and report suspicious transactions to support.
- Watch for phishing that exploits the incident. GMO says staff never ask for passwords or card data by email or phone.
- Wait for GMO's further findings and its service resumption announcement.
-
Onamae Desktop Cloud (GMO Internet) breached; malware installed on up to 26,739 customer VPS servers
ler a análise desta fonte ocultar
Hackers compromised the infrastructure of Onamae.com Desktop Cloud, a VPS service operated by GMO Internet in Japan, and installed malicious programs on up to 26,739 customer servers. The company confirmed the intrusion on October 20, 2026. It began progressively shutting down customer servers at 04:00 local time on October 21, and all Desktop Cloud plans are affected. The data stored on the impacted servers may have been exposed, but GMO has not confirmed any misuse or leak. Payment data such as credit card details is stored on separate infrastructure and is reportedly unaffected. The service is marketed for FX automated trading with MetaTrader 4 (MT4).
Technical Details
- An unauthorized third party gained access to Desktop Cloud infrastructure and installed "unauthorized programs" in some customers' server environments.
- The article gives no initial access vector, malware family, attribution or IOCs.
- GMO warns of an increased risk of phishing and other unsolicited communications that exploit the incident.
Remediation
- Rotate passwords and other secrets that were stored on Desktop Cloud servers as soon as possible.
- Treat emails or calls asking for passwords or credit card details as suspicious. GMO says it will never request them by email or phone.
- No restart date for the service has been given. GMO says it will publish updates as the investigation continues.