Cloud
Onamae Desktop Cloud breach: 26,739 servers shut down
Intruders planted malware on GMO's Onamae.com Desktop Cloud, stole saved trading logins and are extorting the provider. What customers should do now.
GMO Internet has shut down every plan of Onamae.com Desktop Cloud, a Windows virtual private server (VPS) service sold in Japan mainly for running MetaTrader 4 and 5 (MT4/MT5) trading bots around the clock. On October 20 the company confirmed that a third party had installed malicious programs in some customers' server environments. From 04:00 Japan time on October 21 it began stopping servers on all plans, and it counts 26,739 servers as potentially affected. GMO stresses that this is the number in scope, not the number confirmed as breached.
By October 24, GMO said its investigation had found a security problem in the service's own system, that customer information had been taken outside the company, and that customers were reporting trades they never placed. The attacker has demanded about 8 billion yen and threatened to attack customers' home PCs. If you rented one of these desktops, or you run trading or business tools on any hosted Windows desktop, the checks below apply to you.
How it works
Customers reach these desktops over Remote Desktop Protocol (RDP), using a connection file (.rdp) downloaded from the provider's control panel. Inside the desktop they install MT4 or MT5 and save their broker login so the bot can trade unattended. Every saved login is therefore readable by anyone who gets code running on that server.
GMO has not said how the intruders got in. Its reports so far name only "a security problem in the service's system" and "unauthorized access to the service environment", which in our reading points at the provider's own infrastructure rather than at individual customer passwords. The entry route is still under investigation with an outside security firm. In a blog post on the incident, GMO chief executive Masatoshi Kumagai wrote that the company's own white-hat team had flagged security issues with the service to the operations team beforehand, and that the fixes were not deep or fast enough.
The home PC threat is less clear. People claiming to be the attackers say the .rdp files GMO distributed had drive redirection switched on. That RDP feature maps the connecting computer's local disks into the remote session, where they appear as \\tsclient\C and so on. If it is enabled, code on a compromised server can read and write files on the customer's own PC for as long as the session is open, without any exploit. GMO has neither confirmed nor denied this, and nobody has verified the attackers' sample data. Treat it as plausible but unproven.
What attackers are doing
The incident came to light through customers. GMO opened an investigation on October 19 after an inquiry, confirmed the malicious program on October 20 and suspended new sign-ups and the control panel the same day. From October 21 customers reported unauthorized operations in their trading accounts. Brokers began warning their own clients on October 22; OANDA Japan told customers to change their MT4/MT5 passwords, turn on two-factor authentication and review their trading history.
The extortion started early. GMO says an extortion email arrived on October 21 demanding about 8 billion yen, and Impress Watch quotes Kumagai putting it at 50 million US dollars. According to GMO's fourth report, the attacker threatens to keep placing unauthorized orders on accounts at more than 70 domestic and foreign securities and FX firms, to leak data from the service and from customers' PCs, and to run ransomware. Later the attacker set a deadline of 12:00 on October 27 for publishing customer data and attacking home PCs.
GMO refuses to pay, has handed evidence to the police and, on October 24, formally asked the government to use its new active cyber defense powers, which the company describes as the first such request. It has collected customers' PCs for analysis. As of 11:59 on October 27, none of the devices analysed so far contained malware or ransomware, although GMO says not every device has been checked yet.
What to do if you used Onamae.com Desktop Cloud
- Change your broker passwords from a different device. Use a phone or a PC that never connected to the hosted desktop. Change the MT4/MT5 trading password and the broker's member page password, and switch on two-factor authentication where the broker offers it.
- End every open session. GMO warns that with some brokers a password change leaves existing connections alive for a while, so an attacker already logged in can keep trading. Use the broker's account page to terminate sessions, or call the broker and ask them to do it.
- Check trading history and balances back to at least mid-October. Report unrecognised trades to the broker first, then to GMO, with the date, content and loss of each trade. GMO says it will cover realised losses from trades it confirms as unauthorized, including fees, even where the exchange refuses a refund; it excludes market losses and lost profits.
- Check the PC you connected from. Run a full scan with up-to-date antivirus. Look in your Startup folder (
shell:startupin the Run dialog) and inC:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUpfor files you did not put there, since those folders can be written through a redirected drive. Back up your own data first, keep the copy offline, and do not restore program files from it. - Assume the attacker has the full contents of the desktop, and rotate everything else it held: browser-saved passwords, email accounts, exchange API keys, and any password reused elsewhere.
- Do not engage with the attacker. GMO asks customers not to open links or files or reply to messages from people claiming to be the attackers, and to ignore offers to "recover" losses for a fee. GMO will never ask for your password or authentication codes.
Do not expect the old servers back. GMO says the current system will not be restarted as is. It is paying every current customer 5,000 yen and offering six months of a replacement Windows desktop on an independent cloud platform, free, with no migration unless you agree. Details were promised by email by 23:59 on October 30, and the claims procedure for trading losses on November 6. If you move, build the new desktop from scratch and enter only freshly changed passwords.
Lessons for anyone renting hosted desktops or VPS
A hosted desktop holds whatever you type into it. If the provider's management layer falls, your server falls with it, however well you patched Windows inside it. Keep long-lived credentials off it where you can: use broker API keys with trading-only permissions and no withdrawal rights, and IP restrictions to the server's address if the broker supports them.
Open any .rdp file a provider gives you in a text editor before using it. The line drivestoredirect:s:* shares all local drives; an empty value shares none. In the Remote Desktop client, untick Drives under Local Resources, then More, unless you need file transfer for that session. Microsoft documented the same risk in October 2024, when Midnight Blizzard sent rogue .rdp files with redirection enabled to steal files from victims' machines.
Finally, do not plan recovery around provider snapshots. A snapshot taken after the intrusion carries the malware with it, and here the provider withdrew the whole platform. Keep your bot configuration and scripts in a copy you control, so a rebuild elsewhere takes hours.
Our platform and cloud engineering team designs hosted environments with this separation in mind, and our security operations team handles incident response when a supplier is hit. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: GMO second report (English), GMO third report, GMO fourth report, GMO fifth report, GMO ninth report, Masatoshi Kumagai blog, Check Point Research weekly report, BleepingComputer, ASCII.jp, Impress Watch, FX News Group on OANDA Japan, Yasashii Cybersecurity, AI Jitan Lab, Microsoft Learn: RDP properties, Microsoft Security Blog on Midnight Blizzard.