GMO Internet Group took the unusual step of ordering an immediate shutdown of virtual machines for users of its Onamae.com Desktop Cloud service on October 27, 2024. The emergency directive served as a preemptive “kill switch” response to a credible threat from an attacker who claimed to have compromised the service’s management infrastructure.
The incident began when a threat actor contacted the Japanese internet giant, claiming to have gained unauthorized access to the environment. The attacker set a hard deadline of 10:00 PM JST to launch a widespread ransomware attack across the platform. Facing a narrow window to protect user data, GMO issued a public alert instructing customers to manually shut down their virtual PCs and disconnect them from the internet before the deadline passed.
The Risks of Managed Desktop Environments
The Onamae.com Desktop Cloud is a Desktop-as-a-Service (DaaS) platform that provides users with Windows-based virtual desktop environments. These systems are often used for remote work, automated trading, or resource-heavy applications that require high availability. Because these desktops are managed through a centralized layer, a breach at the administrative level represents a critical risk; an attacker with management-level access could theoretically bypass individual endpoint security to deploy malware across thousands of virtualized workstations simultaneously.
By issuing the shutdown order, GMO effectively neutralized the network paths the attacker would have needed to execute the encryption process on individual user machines. This move, while disruptive to business operations, was designed to ensure that even if the management layer was compromised, the active data on customer workstations remained inaccessible to the ransomware payload.
Investigation and Resolution
Following the emergency shutdown and the passing of the attacker’s deadline, GMO Internet Group launched a comprehensive forensic investigation into the scope of the unauthorized access. The company eventually reported that while an intruder had indeed accessed parts of the service environment, there was no evidence that ransomware was successfully executed on any customer systems.
The investigation focused on identifying the specific entry point used by the threat actor and whether any sensitive customer information was exfiltrated before the shutdown. GMO confirmed that the primary threat—the systematic encryption of user desktops—was avoided. The service was gradually restored after security teams verified the integrity of the infrastructure and implemented additional safeguards to prevent a recurrence of the management-layer breach.
This incident highlights a growing trend where threat actors target service providers and management platforms to achieve maximum leverage. In this case, the decision to sacrifice service availability for data integrity allowed GMO to navigate a high-pressure extortion attempt without the loss of customer files.
