In October 2026, Japan’s largest internet infrastructure conglomerate, GMO Internet Group, suffered a catastrophic security breach targeting its flagship Windows Virtual Private Server (VPS) platform, “Onamae.com Desktop Cloud.” Following the discovery of unauthorized intrusions and malicious malware implants capable of scraping credentials, GMO took the unprecedented step on October 21 of forcefully suspending all 26,739 active virtual machines across all subscription tiers. The crisis escalated dramatically on October 27 when threat actors surfaced a dedicated portal, CORONAMNG.STORE, designed to publish ransom demands and showcase stolen user data. This comprehensive technical investigation dissects the incident timeline, exploitation vectors, and the critical hazards surrounding the adversary site.
1. Incident Timeline and Scope of Compromise
Onamae.com Desktop Cloud held an overwhelming market share in Japan among retail forex traders and algorithmic investors running automated trading robots (Expert Advisors) on MetaTrader 4 and 5 (MT4/MT5) around the clock.
- October 19–20: Anomalous egress traffic, unauthorized scheduled tasks, and rogue binaries were reported by users and telemetry, prompting emergency internal triage.
- October 21 (04:00 JST): Acknowledging that the breach encompassed the underlying virtualized fleet, GMO halted all 26,739 VPS instances, severed control panel access, and paused new sign-ups indefinitely to prevent active lateral movement.
- October 24–26: Digital forensics confirmed that attacker-planted implants had systematically extracted credentials, memory dumps, and cached files from compromised virtual machines.
- October 27: The threat group launched “CORONAMNG.STORE” as a public-facing extortion and disclosure showcase, prompting urgent national cybersecurity advisories.
2. Attack Vectors and Structural Exploitation Analysis
Forensic indicators point toward a systemic compromise at the hypervisor orchestration or management control plane level rather than isolated brute-force intrusions against individual virtual machines.
- Fleet-Wide Binary Deployment: Attackers gained sufficient internal administrative velocity to push automated credential harvesters and remote access trojans (RATs) into thousands of isolated guest Windows environments simultaneously.
- Targeted Harvesting of Financial Secrets: The planted malware specifically targeted Windows LSASS process memory, decrypted browser keystores, and scanned common desktop directories for plaintext API tokens, broker logins, and MT4 account configurations.
3. Threat Intelligence: Dissecting “CORONAMNG.STORE”
The newly registered domain, CORONAMNG.STORE, functions as the threat actor’s command-and-extortion bulletin board. Cybersecurity agencies and law enforcement have issued explicit directives warning against navigating to this domain.
Critical Reasons to Avoid CORONAMNG.STORE
- Drive-By Download Exploitation: The threat actor’s web assets are highly suspected of weaponizing zero-day browser exploits to compromise inquisitive researchers and victims upon arrival.
- Telemetry Ingestion and Retargeting: Inbound visitor IPs and network signatures are logged by adversaries to map out corporate networks and stage secondary phishing incursions.
- Phishing and Credential Reclamation Scams: Fraudulent mirror domains mimicking CORONAMNG.STORE are already circulating, deceptively claiming to “search for leaked accounts” in order to harvest personal identities.
4. Architectural Lessons for Cloud Financial Workloads
The Onamae.com breach serves as a stark reminder of the shared responsibility model’s fragile assumptions. When a hosting provider’s management perimeter collapses, isolated workloads containing liquid financial conduits are instantly exposed. Enforcing hardware-bound multi-factor authentication (MFA), adopting zero-trust memory segmentation, and eradicating plaintext credential storage in cloud-hosted trading environments have transitioned from best practices into existential mandates.