Japanese internet services provider GMO Internet urged customers to back up their data and shut down their computers on Oct. 27 after attackers threatened to deploy ransomware and publish stolen information.
The warning followed an attack on the company's Onamae.com Desktop Cloud service and a ransom demand of approximately 8 billion yen ($50 million). The attackers threatened to carry out their plans at noon Japan time. GMO advised customers to run antivirus scans and disconnect their PCs from the network. They were then told to shut down their computers before the deadline.
GMO refused to pay, saying there was no guarantee the attackers would delete stolen information or refrain from misusing it. The attackers subsequently published information they claimed belonged to GMO and its customers, although the company was still verifying its contents. The site hosting the purported stolen data was taken down the following day.
GMO has since reported that examinations of customer devices found no evidence of malware infections or ransomware attacks. The investigation remains ongoing, and the company has offered a bounty of up to $1 million for information leading to the identification of the attackers. By Oct. 29, it had received 321 tips and said investigators had uncovered potential leads.
How the Attack Put Customer Trading Accounts at Risk
GMO began investigating the intrusion on Oct. 19 after receiving a customer inquiry. The following day, it discovered malicious software installed in some customers' hosted server environments. Its investigation subsequently uncovered security vulnerabilities in the Desktop Cloud service.
On Oct. 21, GMO began shutting down the service across all plans to prevent further damage. The company identified 26,739 potentially affected servers, some of which stored login credentials for financial trading applications.
Customers also reported unauthorized transactions in securities and foreign exchange trading accounts. GMO said attackers may have obtained trading account credentials stored in the hosted environments and used them to access customers' accounts, although the company has not established exactly how the intrusion occurred.
GMO has promised to reimburse customers for verified losses resulting from unauthorized trades. It also announced a separate payment of 5,000 yen (about $33) to each customer using the service.
“What stands out about the GMO Internet incident is that attackers reportedly went beyond stealing customer information and gained access to trading accounts, enabling unauthorized financial transactions,” said Phillip Wylie, chief security evangelist at Suzu Labs. “This demonstrates how a vulnerability in a remote access service can have consequences far beyond the compromised system.”
What Investigators Still Don't Know
Despite identifying vulnerabilities in its Desktop Cloud service, GMO has yet to explain how the attackers initially broke in. The company also hasn't established the full extent of the data exposure, and its examination of customer devices remains ongoing.
“Was this a vulnerability in GMO’s infrastructure?” said John Strand, owner of Black Hills Information Security. “Was it credential harvesting that allowed the attackers to gain access? Was it something else entirely? We honestly do not know yet.”
GMO's investigation has produced some leads. On Oct. 29, the company said its white-hat hacker team had obtained information that could help identify the perpetrators and planned to provide it to police and other authorities. It did not publicly disclose the evidence or explain how the attackers compromised its systems.
“I give GMO definite credit for taking responsibility and telling customers, under no uncertain terms, to shut these systems down,” Strand said. “At the same time, there is a huge responsibility to their customers and the broader security community in Japan to release the indicators of compromise associated with this attack as quickly as possible.”
Securing Hosted Remote Desktop Environments
Wylie recommends strengthening remote access security with multifactor authentication and monitoring for suspicious account activity. He also advocates penetration tests that examine what attackers could accomplish after gaining access, rather than simply identifying vulnerabilities.
“The biggest takeaway is that preventing the initial compromise is important, but limiting what attackers can do once they gain access is equally critical,” he said.
GMO also warned customers that changing their trading account passwords might not terminate existing sessions, potentially allowing attackers to continue making transactions. It urged customers to disconnect all active sessions, contacting their brokerage firms if necessary.
