VULNpocalypse
HighBreach / campaignActive

GMO Internet Onamae Desktop Cloud breach leaks data, draws ransom demand and unauthorized FX trades

GMO Internet shut down its Onamae Desktop Cloud after a breach, an 8 billion yen extortion demand, a data leak and unauthorized trades on customer accounts.

Published
Updated
Exploitation
Yes, a broker confirmed third parties logged in and traded on customer accounts using credentials it believes leaked from the GMO servers

What happened

GMO Internet is investigating a data leak after suspected unauthorized access to its Onamae cloud desktop service, which provides virtualized desktops to financial traders, TechCrunch reported on October 27. The service hosts Windows desktops used for FX trading, according to The Hacker News.

Timeline from the sources:

  • October 20: GMO found that a third party had installed malicious programs on some customers’ servers (The Hacker News).
  • October 21: GMO shut down the servers on every plan and received an extortion demand of about 8 billion yen (about $50 million). Customers began reporting trades they did not recognize (TechCrunch, The Hacker News).
  • October 22: GMO reported the incident to Japanese police. Broker FXTF warned that some customers’ VPS logins may have been stolen (TechCrunch, The Hacker News).
  • October 24: GMO said it had confirmed unauthorized access to the service and exfiltration of customer information, and promised compensation and an alternative service (The Hacker News, TechCrunch).
  • October 25 and 26: GMO began collecting customer devices to look for malware (TechCrunch).
  • October 27: the attackers posted material on their website that they say is information about GMO and its customers. GMO was still checking whether it is genuine (TechCrunch, The Hacker News).
  • October 28: the attackers’ site domain and its mirrors were taken down at about 4 a.m. Japan time, and GMO opened a bounty program of up to $1 million in total for tips leading to an arrest or an international wanted notice (The Hacker News).

Scope. GMO counts 26,739 servers as potentially affected, which is not the number of confirmed break-ins or data thefts (The Hacker News). TechCrunch rounds this to 27,000 servers (TechCrunch). Anything customers stored on the servers may have been viewed, including login credentials saved in MetaTrader 4 and 5. GMO does not keep payment card data on the servers (The Hacker News).

Downstream account abuse. OANDA Japan confirmed that a third party logged in to and traded on some of its customers’ accounts using ID and password pairs it believes leaked from the GMO servers. As of October 26 it had found no break-in or leak in its own core systems (The Hacker News).

Ransomware threat. GMO says the attackers threatened to keep manipulating customers’ accounts at more than 70 securities and FX firms, to publish information, and to hit customers’ PCs with ransomware. They set noon on October 27 for publishing customer information and launching the ransomware attack. No ransomware attack had been confirmed as of 1:55 p.m. Japan time that day (The Hacker News). Of the customer PCs analyzed by 11:59 a.m. on October 27, none showed malware, but the analysis is ongoing and does not prove every device is safe (The Hacker News).

How the attackers got in is not confirmed. GMO Internet Group head Masatoshi Kumagai wrote that the group’s own white-hat hackers had warned the service team about problems in advance, and that the response was not fast or thorough enough. The attackers claimed on their site that one administrator account was shared across all servers and that customers’ PC drives were visible from the servers by default. They also claimed a flaw in the service reached customers’ own PCs. GMO had not publicly confirmed these claims (The Hacker News).

Artex. About a week earlier, GMO’s cybersecurity unit reported evidence that a Chinese AI-enabled penetration testing tool called Artex had been used in hacks targeting companies across Japan. GMO said it has not publicly established a connection between Artex and the Onamae breach (TechCrunch). Attribution of the Onamae attack is not confirmed.

Am I affected?

You are potentially affected if any of the following applies:

  • You were a customer of Onamae.com Desktop Cloud (Onamae Desktop Cloud), on any plan (The Hacker News).
  • You saved trading-account logins in software such as MetaTrader 4 or 5 on those servers (The Hacker News).
  • You connected to your broker, for example OANDA Japan or FXTF, from a Desktop Cloud or other VPS server. FXTF told customers who connected to Desktop Cloud to change their FXTF passwords from a device that had never connected to it (The Hacker News).
  • You visited the attackers’ website. GMO says the attackers collected information about visitors (The Hacker News).

GMO had not confirmed any impact on its other services as of October 28 (The Hacker News). How many customers’ data was published is not confirmed.

What to do now

These steps follow GMO’s guidance to Desktop Cloud customers (The Hacker News), which also matches its advice to reset passwords (TechCrunch).

  1. Change trading-account and trading-software passwords from a device not used for FX trading, such as a phone.
  2. End every logged-in session, through the broker if needed, even after changing the password.
  3. Check trading history and balances, and report unrecognized trades to the broker first.
  4. Turn on two-factor authentication wherever the broker offers it.
  5. Change passwords reused on other services or saved in the browser.
  6. Run a full antivirus scan on every device used to connect, and back up your data.
  7. Do not reply to anyone claiming to be behind the attack, and do not open their links or files. Ignore offers to recover lost money for a fee. GMO says it will never ask for a password or authentication code.
  8. Do not visit the attackers’ site or any new one, and do not repost or link to the leaked material. If you already visited, run a full antivirus scan.
  9. Expect compensation details. GMO says it will pay every current user 5,000 yen and cover actual trading losses and fees from trades it confirms were unauthorized and caused by the breach. Customers whose published information it confirms will also get 10,000 to 25,000 yen per type of information exposed. GMO will not restart the service on the breached systems, and a move to a separate service, free for six months and only with consent, was to be detailed by October 30 (The Hacker News).
  10. For defenders more broadly, the CrowdStrike-reported Artex attacks on South Korean financial institutions largely relied on weak security controls such as missing multi-factor authentication (TechCrunch). Check that MFA is enforced on your own remote access and trading platforms.

Sources