GMO Internet Ransomware Ultimatum Sparks Urgent Alert
Japanese technology giant GMO Internet issued an unprecedented emergency advisory to its subscribers. Specifically, the corporation urged clients to disconnect desktop computers, sever internet connections, and unplug power cables immediately. This drastic warning followed an extortion ultimatum from cybercriminals who breached the provider’s hosting infrastructure. The syndicate threatened to deploy devastating file-encrypting malware while publishing confidential client records simultaneously. Consequently, the firm initiated emergency protocols across its Japanese operations.
Extortion Demands and Emergency Containment
The immediate danger targeted the Onamae Desktop Cloud platform. Currency traders rely heavily on this virtual environment to conduct automated transactions. Threat actors designated an execution deadline of midday on October 27 in Japan. Therefore, the service provider advised users to conduct thorough antivirus examinations and secure offline archives. In an urgent Japanese security advisory from GMO, technicians urged customers to disconnect network adapters before the deadline.
The foundational security intrusion unfolded a week earlier. On October 20, internal specialists detected foreign penetration within server clusters. Consequently, administrators began suspending hosting operations across all tiers the following day. This perimeter collapse exposed up to 26,739 hosted environments to malicious tampering. Furthermore, the company warned that attackers likely compromised login credentials for MetaTrader 4 and MetaTrader 5 trading applications.
Refusing the Fifty-Million-Dollar Ransom
The situation deteriorated as customers discovered fraudulent trades executed on their brokerage portfolios. In response, provider staff urged clients to terminate persistent sessions and rotate credentials promptly. Subsequently, the threat actors demanded a staggering ransom of eight billion yen, equivalent to fifty million dollars. However, executive management categorically refused the extortion demand. As outlined in an English corporate statement by GMO Internet, leadership asserted that extortion payments cannot guarantee permanent file destruction.
Assessing Post-Deadline Leaks and Physical Inspection
Fortunately, the anticipated wave of widespread encryption failed to materialize when the deadline passed. Internal monitors confirmed that no active ransomware detonation struck client endpoints. However, the criminals began leaking disputed documents across unauthorized communication channels shortly after midday. Corporate analysts are currently evaluating the authenticity of the leaked files.
Meanwhile, GMO technicians have begun collecting physical workstations from subscribers for direct forensic examination. External cybersecurity firms, including Trend Micro, joined the investigation to uncover latent malware implants. Furthermore, the company pledged to replace hardware suffering verified ransomware damage and reimburse validated trade losses. Ultimately, leadership continues cooperating with law enforcement while warning users against fraudulent customer support solicitations.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
