Massive malware infection hits Onamae Desktop Cloud VPS service
Hackers slipped malicious code onto as many as 26,739 virtual servers hosted by Onamae Desktop Cloud, one of Japan’s biggest VPS providers.
How the breach unfolded
Onamae.com, operated by GMO Internet, first noticed the intrusion on October 20. By the next morning, at 04:00 local time on October 21, the firm began taking the affected machines offline, one by one.
The attackers gained foothold in the provider’s infrastructure and dropped “malicious programs” into customer environments. No details on the payload were released, but the sheer scale suggests an automated deployment.
Who is affected
All customers of the Desktop Cloud byGMO service – a platform marketed for 24/7 Forex trading with MetaTrader 4 – are potentially in the cross‑hairs. Payment data such as credit‑card numbers remain safe, according to GMO, because billing is processed on a separate system.
Company response
GMO Internet announced a full service interruption for every Desktop Cloud plan, starting at 4 a.m. on October 21. There is no public ETA for when the servers will be back online.
Unconfirmed fallout
Unverified: the breach may have exposed data stored on the compromised servers, and customers who kept passwords or API keys on those machines could see them stolen.
Unverified: threat actors might launch phishing campaigns that reference the outage to lure victims.
What you can do right now
Even though payment information is reportedly untouched, the safest course is to assume any credentials stored on Onamae Desktop Cloud instances are compromised.
- Rotate all passwords, SSH keys, and API tokens that were used on Onamae Desktop Cloud instances.
- Scan the servers with up‑to‑date anti‑malware tools as soon as they are back online.
- Review logs for any suspicious outbound connections that could indicate a backdoor.
- Consider moving critical workloads to a different provider or to a segregated environment while the investigation continues.