How to read an .rdp file and what users should do: the Onamae.com Desktop Cloud incident

Onamae.com Desktop Cloud is a cloud-hosted Windows that was used for automated FX trading. Users connect to it from their own PC over Remote Desktop (RDP), using an .rdp file.

On October 24, 2026, the person believed to be the attacker posted an image on their own site showing an .rdp file opened in Notepad. They claimed: “In the file GMO distributed, drive sharing was enabled from the start. That is how we got into users’ PCs.” GMO’s announcements do not address this point (through the 6th notice). It also has not been confirmed whether the image shows the distributed file itself.

Knowing how to read an .rdp file is still worth it. We confirmed in the lab that if you connect with drives shared, the remote side can read files on your PC and write to it (post ②).

##An .rdp file is a plain-text settings file

An .rdp file is a text file that says where to connect and how. Each line has the form name:type:value. The type s means string and i means integer.

Four kinds of lines matter in this incident. Meanings and defaults follow Microsoft’s property list.

drivestoredirect shares fixed drives in the PC, removable drives such as USB drives, and network drives. If you have mapped a company shared folder as a drive, the remote side can see that too.

##What was in the file the attacker showed

We saved the image from the attacker’s site and counted the lines in it one by one. The image starts at the winposstr line and ends at the drivestoredirect:s:* line, 35 lines in all. The connection target and user name are blacked out. Here is where the four kinds of lines above appear.

So the file contradicts itself about drives. Line 20 says “share nothing” and the last line, 35, says “share everything”.

##When the same line appears twice, which one wins

Microsoft’s documentation does not say how a repeated line with the same name is handled. It may differ by software.

FreeRDP has one more quirk. If the value is empty, as in drivestoredirect:s:, FreeRDP skips it as “not specified”. That differs from how Windows treats it (“do not share”). Either way, the safe approach is to never put two lines with opposite meanings in one file.

##Check your own .rdp file without connecting

Do not double-click your .rdp file. Opening it starts a connection. These two methods let you look inside without connecting.

View it in Notepad

1. In File Explorer, open the right-click menu on the .rdp file and choose “Open with”, then Notepad
2. In Notepad’s find box (Ctrl + F), enter drivestoredirect and keep pressing “Find Next” until the end. Check whether there are two or more matching lines, and whether the value after the colon is empty or *
3. Check the values of redirectclipboard, redirectprinters, and authentication level the same way

See how Windows read it

You can check on your own PC which line Windows uses when there are two. mstsc /edit is a command that opens the settings screen without connecting.

1. Press Win + R, enter mstsc /edit "path\to\file.rdp", and press Enter
2. Open “Show Options”, then “Local Resources”, then “More…”
3. Check whether “Drives” in the list is checked. If it is checked, that PC reads the file as a setting that shares drives
4. Do not press “Connect”. Close the window with the × at the top right

##If you rewrite it

If you will keep using RDP, edit the file in Notepad as follows and save it.

1. Delete all drivestoredirect lines and write just one drivestoredirect:s: line (empty value). If you fix only one of the lines, the remaining one may take effect
2. Set redirectclipboard:i:0. This matters most if you copy and paste passwords
3. Set redirectprinters:i:0
4. Set authentication level:i:2. If authentication fails, a warning appears and you can choose whether to connect

After rewriting, use “See how Windows read it” above to confirm that “Drives” is unchecked.

Keeping Windows up to date also helps. According to Microsoft, starting with the April 2026 security update, opening an .rdp file shows a confirmation screen before connecting, and the sharing the file asks for (drives and so on) is off by default for everything. If you do not check “Drives” on the confirmation screen, nothing is shared.

On the server side, administrators can turn off drive sharing entirely with the server policy fDisableCdm (lab measurements in post ②).

##What to do if you connected to Desktop Cloud

In a statement dated October 24, the person believed to be the attacker wrote that if GMO does not pay $1 million by noon on the 27th (Japan time), they will encrypt users’ home PCs and publish the data they took out (confirmed in a saved copy of the attacker’s site). What you should do is the same before or after the deadline. There is no guarantee they will act as announced, and no guarantee they will keep the deadline. Even if the deadline passes and nothing happens, that does not mean nothing was placed on your PC.

1. Change your passwords. From a device you do not use for FX trading (such as a smartphone), change them in this order: email, FX account and MT4/MT5, then anything saved in your browser. In its 5th notice, GMO also advises doing this “from a device not used for FX trading (a smartphone or a different PC, etc.)”
2. Sign out of active sessions and turn on two-step verification. Changing a password can leave already signed-in sessions alive
3. Run a full antivirus scan and back up your data. GMO asks users to do this in its 5th and 6th notices. However, if files were only read through RDP sharing, a scan has nothing left to find
4. Check your PC’s startup items and Task Scheduler. Shared drives allow writes. Open the folder via Win + R → shell:startup, and check that folder and Task Scheduler for anything you do not recognize
5. Decide whether to cooperate with GMO’s investigation (optional). In its 6th notice, GMO asks users who may have had unauthorized operations to lend the PC they used to connect, for investigation. The scope of the examination and how the PC is returned are shown beforehand in a written confirmation. If you cooperate, reset the PC only after it comes back. GMO will never ask for your password or an authentication code
6. If possible, reset the PC. Move only documents and photos you made yourself to something like a USB drive, and do not move .exe, .bat, .lnk, or archive files. In Reset this PC, choose “Remove everything”. This is our recommendation, not official guidance
7. Do not use your existing .rdp file to connect. If you keep it, only inspect it using the steps above

##If you get a message from someone claiming to be the attacker

• Do not open it. Do not click links or attachments
• Do not reply. Do not pay
• Do not send files. The attacker told users to “keep your .rdp file as evidence for a lawsuit,” but you have no need to hand over files in response to such a request
• Keep the emails and screens instead of deleting them, and consult the National Police Agency’s cybercrime consultation desk (Japanese). If you want your PC examined, do it before you reset it
• Tell family and coworkers, “If a strange email arrives in my name, don’t open it.” The attacker’s statement said that if payment is not made, they would send browsing history and similar data to acquaintances, family, and business contacts in the user’s email address book

##What we don’t know

• Whether the attacker’s image shows the file GMO actually distributed. GMO’s announcements do not address it
• Which line Windows’ standard connection software uses when drivestoredirect appears twice
• How the attacker got into the VPSs. On their own site, the attacker claims that “the VPS group was connected in a single Active Directory environment, and they could move from one VPS to another.” It also claims that one admin-level account worked on every VPS, and that when a support engineer connected to a customer’s PC, the customer could pull that account’s credentials (post of Oct 24). Both are the attacker’s claims; GMO has not addressed them and we could not confirm them. GMO says it is investigating the intrusion path and has not published a cause (through the 6th notice)

##Summary

1. An .rdp file is text. An empty drivestoredirect shares nothing, and * shares all drives
2. The attacker’s image had two drivestoredirect lines with opposite meanings. FreeRDP uses the later line. Windows is unconfirmed
3. Inspect with Notepad or mstsc /edit. Do not double-click
4. To fix it, delete all drivestoredirect lines and write just one empty line
5. Change your passwords and check your PC, whether before or after the deadline