Do Son 
Japanese technology conglomerate GMO Internet Group suffered a catastrophic security compromise across its virtual workspace infrastructure. Specifically, the GMO Desktop Cloud breach impacted over 26,000 servers dedicated to foreign exchange trading. Consequently, cybercriminals exfiltrated sensitive client records and initiated unauthorized financial transactions across user accounts. In response, corporate leadership suspended operations immediately to prevent further damage.
Severe Active Directory and RDP Misconfigurations
On October 24, the extortionists published a detailed breakdown of the internal architectural weaknesses. Specifically, the attackers revealed that centralized Microsoft Active Directory services managed the entire virtual private server network. Furthermore, administrative accounts maintained excessively broad privileges across isolated client nodes. When GMO support technicians connected to remote client machines, technicians inadvertently stored generic superuser credentials in system memory. Consequently, malicious actors harvested these persistent administrative credentials with minimal effort.
In addition, default Remote Desktop Protocol settings introduced severe operational security risks. The cloud platform enabled local drive redirection across all remote sessions by default. Therefore, compromised virtual instances automatically mapped physical drives into active sessions. As a result, intruders accessed internal infrastructure files without triggering security alarms.
Extortion Demands and Emergency Incident Response
According to the extortionists, these architectural vulnerabilities existed within the hosting platform since 2019. Subsequently, the threat actors planted persistent backdoors and demanded a one million dollar ransom by October 27. However, GMO Internet Group decisively rejected all extortion demands. Instead, executives delivered forensic telemetry to Japanese law enforcement investigators. Meanwhile, the company collaborated with foreign exchange brokerages to freeze unauthorized trades and terminate compromised sessions.
Decommissioning Legacy Infrastructure and Customer Redress
Technical teams first observed anomalous account behavior on October 19. By October 20, forensic investigators discovered malicious implants across production environments. Therefore, engineers initiated an orderly platform shutdown early on October 21. As detailed in the GMO incident disclosure on Desktop Cloud server suspension, developers permanently retired the legacy product architecture. Furthermore, the vendor pledged that it will not restore the compromised systems in their prior state.
To assist affected subscribers, GMO announced an initial compensation payment of 5,000 yen per customer. Moreover, the corporation pledged complete financial reimbursement for verified trading losses and associated brokerage fees. Ultimately, rebuilding customer trust will require an uncompromising commitment to zero-trust architecture.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
