GMO Onamae.com Desktop Cloud breach: what is affected

A breach of one provider's FX trading servers has become an extortion campaign aimed at its customers' own PCs. GMO Internet's Onamae.com Desktop Cloud rents Windows servers that traders use to run MetaTrader 4 and 5 around the clock. On 20 October 2026 GMO found a malicious program on them. By 27 October it was asking customers to back up, unplug and switch off their home PCs before a noon deadline set by the attackers. This analysis starts with what is affected and what is not, then separates GMO's findings from the attackers' claims, and ends with checks you can run on your own PCs, mail and suppliers.

What is affected, and what is not

Status as of GMO's 13th report on 28 October 2026. "Confirmed" means GMO or a broker said so in its own notice; "claimed" means only the attackers said so.

Area	Status	What is known
Onamae.com Desktop Cloud, all plans	Affected (confirmed)	A malicious program was found on 20 October and all plans were stopped from 04:00 on 21 October. Up to 26,739 servers may be affected; GMO says this is not a count of confirmed intrusions. The current platform will not be restarted; customers are offered a replacement on separate infrastructure, free for six months.
Trading logins saved on the servers (MT4/MT5, broker accounts)	Affected (confirmed)	Taken and used by a third party. GMO received reports of unauthorised trades, and the broker OANDA Japan confirmed unauthorised logins and trades on some customers' accounts.
Customer information held for the service	Affected (confirmed)	GMO confirmed on 24 October that customer information was taken out. It has not said which details or for how many customers.
Information posted by the attackers	Published, not verified	On 27 October GMO confirmed that material the attackers describe as information about GMO and its customers had been posted; reports put it at one person's details. The site was down by 28 October. GMO says it may contain false content and asks people not to view or share it.
Customers' own PCs	Claimed, not confirmed	The attackers say the .rdp connection files shared customers' local drives and that they planted backdoors. As of 11:59 on 27 October GMO had found no malware, including ransomware, on the PCs it had finished analysing.
Brokers' own systems	Not affected, per OANDA Japan	OANDA Japan says its management systems were not accessed; the logins came from the servers.
Other GMO services and group companies	No impact reported	No notice names them, but GMO has not published the cause, so this is "not reported", not "cleared".

If your company lists GMO companies as suppliers, the shared name is not the risk. GMO Internet Group is many companies. What matters is whether one of them runs on the same systems as Desktop Cloud, and none has been named. Ask them, and check the two paths that are in your own hands: staff who used the service, and mail that uses the GMO name.

What GMO has confirmed

GMO has published at least 13 numbered reports since 21 October, through GMO Internet Group (group.gmo), GMO Internet (internet.gmo) and the Onamae.com news page.

Figure 1. Two weeks of reports, as of 28 October. Original graphic for this article.

20 October. GMO found that a third party had placed a malicious program in some customers' server environments. INTERNET Watch (Japanese)
21 October, 04:00, 1st report. All plans were stopped in sequence. Up to 26,739 servers may be affected. GMO's own timeline also records an extortion email demanding about 8 billion yen at this point. Onamae.com (Japanese) · INTERNET Watch via Yahoo! News (Japanese)
22 October, 2nd report. Login details for trading accounts stored on the servers may have been taken and misused. Customers had reported unauthorised operations on their accounts since 21 October. GMO consulted the police. OANDA Japan told its customers who ran MT4/MT5 on the service that their IDs and passwords may have been seen. GMO Internet Group, 2nd report (Japanese) · OANDA Japan, 1st notice (Japanese)
24 October, 4th report. GMO said the service's system had a security problem and that customer information had been taken out. It will pay 5,000 yen to every current customer, cover actual losses from unauthorised trades (application details by 6 November), and offer a replacement service free for six months instead of restarting the platform. It also asked government agencies to act under Japan's active cyber defence framework. GMO Internet Group (Japanese) · Business+IT via Yahoo! News (Japanese)
26 October, 6th and 7th reports. GMO repeated four requests to customers, and reported that the attackers had threatened to publish customer data and run ransomware at noon on 27 October. OANDA Japan confirmed unauthorised logins and trades on some accounts and restricted trading. GMO, 6th report (Japanese) · OANDA Japan, 2nd notice (Japanese)
27 October, morning, 8th report. Back up, disconnect and switch off PCs by noon. GMO said it would give customers whose PCs were hit by ransomware a new PC of equal performance. ITmedia NEWS (Japanese) · ITmedia NEWS via Yahoo! News (Japanese)
27 October, 11:59, 9th report. No malware, including ransomware, on the PCs analysed so far; analysis continues. GMO Internet, 9th report · BleepingComputer
27 October, 12:30 onwards, 10th to 12th reports. GMO confirmed the attackers had posted material about GMO and its customers and asked people not to view or share it. It will not pay, and will make a special payment of up to 3 million yen to customers whose own information is confirmed in what was posted. GMO Internet Group offered a bounty of up to US$1 million for information leading to an arrest or an international wanted notice, open until 27 October 2027. Jiji via Yahoo! News (Japanese) · GMO Cybercrime Bounty · BankInfoSecurity
28 October, 13th report. The site where the material was posted had been taken down. GMO Internet Group, 13th report (Japanese) · TechCrunch

What the attackers claim

None of these claims has been verified by GMO or by us. They matter because they say where to look.

The ransom. About 8 billion yen (roughly US$50 million) at first, later cut to US$1 million (about 160 million yen). Security Measures Lab (Japanese)
The way in. The attackers point to central management of the servers through Active Directory and an administrator right shared across them. A single program appearing on many customers' servers at once fits a central path better than thousands of separate break-ins, but GMO has not confirmed any route.
Customers' PCs. They say the .rdp connection files GMO handed out shared the customer's local drives by default, and that they used this to reach home PCs and plant backdoors.
The timing. An OSINT analysis of logs the attackers posted finds information-gathering records against ten servers and the PCs connected to them between 22:53 and 23:16 on 14 October, including 4,352 file copies: six days before GMO's detection. The analysis notes that the time zone and the logs themselves are unverified. Hamanoya OSINT report (Japanese)
More publication. They said they would post more data every day at noon.

Why the drive-sharing claim is plausible

When a Remote Desktop connection shares drives, the local disk appears inside the remote session as \\tsclient\C. Anything running on the server can then read the PC's files and write new ones, for example into the user's Startup folder, for as long as the session is open. The setting lives in the .rdp file: drivestoredirect:s:* shares every drive, and an empty value shares none. Microsoft Learn: supported RDP properties

This is a known attack pattern, not a theory. In October 2024 Microsoft described Midnight Blizzard sending .rdp files that connected victims to attacker-controlled servers and shared their local resources, including drives. Microsoft Security Whether it happened here is unproven, but it is why GMO's advice to switch PCs off was reasonable before anyone could check.

The attacker's playbook: what this case enables

Step	ATT&CK	Status in this case
Reach many customers' servers at once through central management	T1078.002 Domain Accounts, T1072 Software Deployment Tools	Claimed by the attackers; route not confirmed
Collect broker logins saved in trading tools	T1552.001 Credentials In Files, T1555 Credentials from Password Stores	Confirmed: logins taken
Log in to brokers and trade from victims' accounts	T1078 Valid Accounts, T1657 Financial Theft	Confirmed by GMO and OANDA Japan
Read customers' PCs through shared drives	T1039 Data from Network Shared Drive	Claimed
Plant a backdoor on the PC through the shared drive	T1080 Taint Shared Content, T1547.001 Startup Folder	Claimed; none found on PCs analysed by 27 October
Take customer information out	TA0010 Exfiltration	Confirmed; method not published
Extort with a ransom, a deadline and a leak site	T1657 Financial Theft; T1486 Data Encrypted for Impact threatened	Demand confirmed; encryption not confirmed
Phish customers and companies with the GMO name	T1566 Phishing	Expected; no campaign reported yet

The defender's playbook

1. If you or your staff used Onamae.com Desktop Cloud

From a different, clean device, change broker and MT4/MT5 passwords, end all sessions, turn on two-step verification and check trade history. GMO and OANDA Japan both ask for this.
Check the .rdp file you connected with by opening it in Notepad, not double-clicking it. If it contains drivestoredirect:s:*, the server could see your drives while you were connected; treat that PC as suspect.
Look at the PC: run a full scan, review the Startup folder and Run keys for anything you do not recognise, and if in doubt rebuild it or use GMO's PC analysis and replacement offer.
Do not reconnect with the old .rdp file. Double-clicking it starts the connection.

2. Find out whether it touched your organisation

Look for shadow use. Run the outbound-RDP and .rdp-file hunts below. A company PC that connected to a trading server at home is the one path that brings this incident inside.
Block outbound RDP (TCP 3389) to the internet at the egress firewall, with named exceptions only.
Turn off drive sharing on managed PCs. On Windows, set the DWORD DisableDriveRedirection to 1 under HKEY_LOCAL_MACHINE\Software\Microsoft\Terminal Server Client by Group Policy or Intune. Microsoft Learn: drive redirection
Block .rdp attachments at the mail gateway; the Midnight Blizzard campaign arrived that way.

3. Suppliers that carry the GMO name

Ask each one for a written answer (template below): whether its service shares systems, administrators or Active Directory with Desktop Cloud, and whether any of your data sat there. Start with suppliers that hold your domains, payments or test findings. A shared brand is not shared infrastructure, and no other GMO service has been named as affected.

4. Expect phishing that uses this incident

Likely lures: the 5,000 yen payment, applications for loss compensation (details due by 6 November), replacement PCs, "check whether your data was published", and the bounty. Real instructions come from GMO's own pages; staff should go there themselves rather than follow a link. Do not visit the leak site, even to check.

5. Which teams should act

Team	Action	Done when
EDR	Run the RDP-client file-write hunt; scan and isolate any PC with hits	Every hit has an owner and a verdict
SIEM	Alert on new outbound RDP to public addresses	The rule is live and tested
Email Security	Run the lure hunt; block .rdp attachments	Lures quarantined; attachment rule on
Third-party Risk	Send the supplier questions to GMO-named suppliers	Written answers on file
IT Operations	Block outbound TCP 3389; push `DisableDriveRedirection`	Policy applied to managed PCs

Hunting: did this incident reach your PCs?

No indicators have been published. GMO has not released attacker addresses, file names or hashes. The queries look in your own estate for the two paths that matter: company PCs that used Remote Desktop to the internet, and files written by the Remote Desktop client, which is what a hostile server's writes look like on the local PC.

All queries are illustrative and were not run against live data. On 29 October 2026 (JST) the KQL was parsed and checked against Microsoft Learn's table schemas, the CrowdStrike field names against the SigmaHQ CrowdStrike pipeline and the LogScale cidr() reference, and Sumo Logic's isPrivateIP against its release notes.

1. Company PCs opening Remote Desktop to the internet. Microsoft Defender XDR advanced hunting.

// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Which PCs open Remote Desktop sessions to servers on the internet? Onamae.com Desktop Cloud users connected this way.
// A corporate fleet rarely needs outbound RDP to public addresses, so every row deserves an owner and a reason.
DeviceNetworkEvents
| where Timestamp > ago(60d)
| where RemotePort == 3389 and RemoteIPType == "Public"
| where ActionType in ("ConnectionSuccess", "ConnectionAttempt")
| summarize Connections = count(), RemoteIPs = make_set(RemoteIP, 20),
    FirstSeen = min(Timestamp), LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName
| order by LastSeen desc

2. Programs, scripts or shortcuts written by the Remote Desktop client. With drive sharing on, this is how a backdoor planted from the server would appear.

// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// With drive sharing on, files a remote server puts on your PC are written locally by the Remote Desktop client.
// mstsc.exe or msrdc.exe writing programs, scripts or shortcuts, or anything into a Startup folder, is how a hostile server would plant a backdoor.
let Since = ago(60d);
let Risky = dynamic([".exe", ".dll", ".scr", ".ps1", ".bat", ".cmd", ".vbs", ".js", ".hta", ".lnk", ".msi"]);
DeviceFileEvents
| where Timestamp > Since
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where InitiatingProcessFileName in~ ("mstsc.exe", "msrdc.exe")
| extend Extension = tolower(strcat(".", tostring(split(FileName, ".")[-1])))
| where Extension in (Risky) or FolderPath contains @"\Start Menu\Programs\Startup"
| project Timestamp, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName,
    ActionType, FolderPath, FileName, SHA1
| order by Timestamp desc

3. .rdp connection files on your PCs, and where they came from.

// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Which PCs hold Remote Desktop connection (.rdp) files, and did any come from onamae.com?
// Open each file found in Notepad: drivestoredirect:s:* means every local drive is shared with the server.
DeviceFileEvents
| where Timestamp > ago(90d)
| where FileName endswith ".rdp"
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| extend FromOnamae = FileOriginUrl contains "onamae" or FileOriginReferrerUrl contains "onamae"
| summarize Files = make_set(FolderPath, 10), Origins = make_set(FileOriginUrl, 10),
    FromOnamae = max(toint(FromOnamae)), LastSeen = max(Timestamp)
    by DeviceName, InitiatingProcessAccountName
| order by FromOnamae desc, LastSeen desc

4. Mail that uses the GMO and Onamae.com names from other domains. Replace the placeholder with GMO's real sending domains as seen in your own mail logs.

// Illustrative; not run against live data. Microsoft Defender XDR advanced hunting.
// Inbound mail that uses the GMO and Onamae.com names but does not come from GMO's real sending domains.
// Expect lures about password resets, the 5,000 yen payment, loss compensation, replacement PCs and "check if your data leaked".
let Since = ago(14d);
let Legitimate = @"(?i)(^|\.)(REPLACE_WITH_LEGITIMATE_GMO_DOMAINS)$";   // for example: onamae\.com|gmo\.jp
EmailEvents
| where Timestamp > Since and EmailDirection == "Inbound"
| where Subject contains "お名前" or Subject contains "デスクトップクラウド"
    or Subject contains "GMO" or Subject contains "onamae"
| where not(SenderFromDomain matches regex Legitimate)
| project Timestamp, RecipientEmailAddress, SenderFromAddress, SenderMailFromDomain,
    Subject, AuthenticationDetails, DeliveryAction, ThreatTypes
| order by Timestamp desc

Download the examples: outbound RDP KQL · RDP client writes KQL · .rdp files KQL · mail lures KQL.

Other platforms. CrowdStrike Falcon (LogScale / Next-Gen SIEM): outbound Remote Desktop to public addresses, then files written by the Remote Desktop client.

// Illustrative; not run against live data. CrowdStrike Falcon (LogScale / Next-Gen SIEM).
// Endpoints opening Remote Desktop sessions to public addresses. Onamae.com Desktop Cloud users connected this way.
// Check the field names in your tenant before relying on an empty result.
#event_simpleName=NetworkConnectIP4 RemotePort=3389
| !cidr(field="RemoteAddressIP4", subnet=["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16", "127.0.0.0/8", "169.254.0.0/16", "100.64.0.0/10"])
| groupBy([aid, RemoteAddressIP4], function=[count(as=connections), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)])

// Illustrative; not run against live data. CrowdStrike Falcon (LogScale / Next-Gen SIEM).
// Programs, scripts, shortcuts and installers written to disk by the Remote Desktop client.
// With drive sharing on, this is what a remote server's writes to your PC look like.
#event_simpleName=/^(PEFileWritten|NewExecutableWritten|ScriptFileWritten|LnkFileWritten|MsiFileWritten)$/
| ContextBaseFileName=/^(mstsc|msrdc)\.exe$/i
| groupBy([aid, #event_simpleName, TargetFileName], function=[count(as=writes), max(@timestamp, as=last_seen)])

Sumo Logic, firewall logs: outbound Remote Desktop to public addresses per source and destination per day.

// Illustrative; not run against live data. Sumo Logic, firewall logs with key=value fields.
// Outbound Remote Desktop to public addresses, per source and destination per day. Adjust the field names to your firewall.
_sourceCategory="REPLACE_WITH_FIREWALL_SOURCE_CATEGORY" "3389"
| parse regex "(?:srcip|src|src_ip)=(?<src_ip>\d{1,3}(?:\.\d{1,3}){3})" nodrop
| parse regex "(?:dstip|dst|dst_ip)=(?<dst_ip>\d{1,3}(?:\.\d{1,3}){3})" nodrop
| parse regex "(?:dstport|dpt|dst_port)=(?<dst_port>\d+)" nodrop
| where dst_port = "3389" and !isNull(dst_ip) and !isPrivateIP(dst_ip)
| timeslice 1d
| count by _timeslice, src_ip, dst_ip
| sort by _timeslice desc

Download: outbound RDP CQL · RDP client writes CQL · outbound RDP Sumo Logic.

No result does not prove nothing happened. Personal PCs used for trading at home are outside company tools, and a firewall that does not log allowed traffic will show nothing. DeviceNetworkEvents · DeviceFileEvents · EmailEvents

Copy-paste templates

Questions for suppliers that carry the GMO name

Subject: Onamae.com Desktop Cloud incident – please confirm your exposure

GMO Internet reported unauthorised access to Onamae.com Desktop Cloud from 20 October 2026.
Please answer in writing by [date]:

1. Does the service you provide to us share any systems, networks, administrator accounts
   or Active Directory with Onamae.com Desktop Cloud?
2. Was any of our data, or any credential we gave you, stored on or reachable from it?
3. Have you found any sign of unauthorised access to your own systems since 1 October 2026?
4. Have any of your staff who work on our account used Onamae.com Desktop Cloud
   from a device that also holds our data?
5. Who is our contact for this incident, and how will you tell us if your answers change?

Thank you.

Checks for a PC that connected to Desktop Cloud

PC CHECK – ONAMAE.COM DESKTOP CLOUD
PC name / owner:                     Checked by / date:

[ ] Trading and broker passwords changed from a different device; sessions ended; 2-step on
[ ] Trade history checked for orders you did not place
[ ] .rdp file opened in Notepad (not double-clicked). drivestoredirect value: __________
[ ] If drives were shared: Startup folder and Run keys reviewed
[ ] Full anti-malware scan completed. Result: __________
[ ] Files written by mstsc.exe since 1 Oct reviewed (EDR hunt 2)
[ ] Decision: keep / rebuild / send for GMO analysis
[ ] Old .rdp file deleted

Note to employees

Subject: Mail about the GMO / Onamae.com incident

GMO Internet's Onamae.com Desktop Cloud, a server service used for automated FX trading,
was breached in October 2026. Expect fake emails and messages that use this news:
compensation of 5,000 yen, loss claims, replacement PCs, "check if your data leaked".

- Do not click links in such messages. Go to GMO's website yourself.
- Do not visit sites said to hold the leaked data.
- If you used Desktop Cloud on a company PC, tell IT Security today.
- Report suspicious messages with the Report button.

What remains unknown

How the attackers got in, and whether access began on 14 October as their logs suggest.
Which customer information was taken, and for how many customers.
Whether any customer PC was actually backdoored or encrypted. GMO's analysis is continuing.
Whether the posted material is genuine, and whether more will be posted.
How much was lost in unauthorised trades.
Whether anything outside Desktop Cloud shared the weakness. No other GMO service has been named.
Who the attackers are. On 21 October GMO Cybersecurity by IERAE reported finding the AI penetration-testing tool ARTEX in attack infrastructure behind a different intrusion into Japanese companies; no source ties it to this case. ScanNetSecurity (Japanese) See our analysis of AI attack platforms aimed at Japan.

Sources and updates

29 October 2026, about 21:00 JST: first published, covering GMO's reports up to the 13th of 28 October. We could not open GMO's own pages (group.gmo, internet.gmo, onamae.com) from our research environment, so their content was checked through search results that quote them and through the news reports above; every figure was confirmed in at least two sources. OANDA Japan's notices were also checked through search results; Microsoft's pages were opened directly. We will update this analysis when GMO publishes the cause.

GMO's Onamae.com Desktop Cloud breach: what is affected, what is not, and what the attackers only claim

30-second briefing