Extortion Group Targets Japan’s GMO Group: $1 Million Bounty Issued for Information on Hackers
In a significant cybersecurity incident, Japan-based GMO Group, a major player in the web hosting and domain registration sector, has taken a bold stance against extortionists who breached its systems. The company has announced a bounty of up to $1 million for information that could lead to the identification and capture of the individuals responsible for a recent cyberattack that resulted in unauthorized trades and the theft of customer data.
This incident came to light following the company’s detection of unauthorized access to its "Onamae.com Desktop Cloud" service, a cloud-based solution used by customers primarily for foreign exchange margin trading. As of October 21, the company revealed that it had suspended this service after receiving a ransom note demanding a staggering sum of 8 billion yen, equivalent to approximately $50 million.
GMO Group operates as one of Japan’s largest web hosting service providers, and its affected service functions as both a virtual private server (VPS) and a Windows virtual desktop service, specifically designed for automated foreign exchange trading. The incident sparked significant alarm among users, as it was reported that attackers may have compromised up to 26,739 virtual servers, potentially installing malware on the home PCs of users who accessed the service. In addition, customer credentials associated with the popular MetaTrader 4 and MetaTrader 5 electronic trading platforms were purportedly compromised, prompting the company to advise customers to reset their passwords immediately.
In a striking postscript to the attack, the extortionists reduced their ransom demand to $1 million just three days after their initial request. They issued a payment deadline of Tuesday at noon, threatening to manipulate trading accounts and publicly disclose sensitive information if the demands were not met. However, rather than bowing to these demands, Masatoshi Kumagai, the company’s founder and CEO, took an alternative approach, offering a reward for credible information that could unveil the perpetrators.
The company launched a dedicated cybercrime bounty website seeking tips that could facilitate the identification and arrest of those involved in the unauthorized activities connected to the Onamae.com Desktop Cloud. The site also welcomes insights regarding any infrastructure linked to the attackers, methods used in the cybercrime, and specifics on how the extortion was orchestrated. Within days of the bounty’s announcement, GMO Group reported having received over 100 tips.
The offer remains on the table for one year or until law enforcement apprehends the criminals or issues an international arrest notice. In the wake of this cyber incident, GMO Group has firmly articulated its stance against paying ransoms. The company affirmed that: "Based on our social responsibility not to encourage such criminal activity, we will not provide the attackers with any funds." This decision stems from the understanding that compliance with the extortionists’ demands does not ensure the deletion of stolen data and could potentially finance further criminal endeavors.
GMO Group has confirmed its collaboration with law enforcement agencies and cybersecurity experts, including Trend Micro, to rigorously analyze customers’ PCs for signs of malicious software and unauthorized activities. In light of the breach, the company has also expressed regret and is extending compensation to affected users. All individuals utilizing the impacted Onamae.com Desktop Cloud service will receive a payment of 5,000 yen (approximately $32), while those whose personal information has been compromised may receive up to 3 million yen, or around $19,000. Additionally, customers who suffered trading losses stemming from the attack will also be reimbursed.
The precise method through which the attackers infiltrated the systems has yet to be disclosed. However, the hackers, who are currently operating an offline data leak site, claimed to have exploited vulnerabilities associated with the remote desktop protocol to gain unauthorized access to the GMO Group’s infrastructure. They asserted that the settings of the Onamae Desktop Cloud had certain weaknesses, particularly concerning "drive redirection," which allowed attackers to access local files when users connected to the VPS. They also alleged that configurations exposed critical admin passwords, facilitating further incursions into the network.
Amid the growing chaos, GMO Group issued a warning concerning the potential deployment of ransomware against its customers, urging users to conduct comprehensive security scans, back up their important data, and disconnect their PCs from all cables. Despite initial fears, it appeared that the threats to deploy ransomware did not materialize. However, the attackers commenced leaking sensitive customer data soon afterward.
As of now, the company has engaged in efforts to shut down the servers hosting the leaked information and has filed multiple takedown requests to social media platforms concerning posts linked to the dissemination of these details. GMO Group has reiterated its commitment to safeguarding customer interests and has called for vigilance from the media regarding the publication of the leaked information.
This incident not only highlights the increasing complexity of cybersecurity risks but also illustrates the proactive measures companies must take to counteract the threats posed by cybercriminals in an evolving digital landscape.