Update: what GMO's 7th to 9th notices say, up to the noon deadline on Oct 27 (Onamae.com Desktop Cloud)

The earlier posts covered up to the 6th notice (Oct 26, 21:00). The 7th, 8th, and 9th notices came after. The biggest change: for the 12:00 deadline on October 27 that the attacker announced, GMO asked users to disconnect from the network and power off their PCs.

##The three notices at a glance

##The 12:00 warning

In the 7th notice, GMO said it had received a warning from the apparent attacker that at 12:00 on October 27 they would publish customer information and carry out a ransomware attack. That is the same time as the “noon on the 27th” deadline on the attacker’s site, which we covered earlier.

GMO’s policy has not changed. It will not comply with the attacker’s demands. The stated reason: complying does not guarantee that the stolen information is deleted or that misuse is prevented. GMO says it is working with the police and other agencies. The demand is listed as “about ¥8 billion” in the 7th notice’s timeline.

##What GMO asks of users (8th and 9th notices)

The 8th notice lists four requests, and the 9th repeats them.

1. Run a full scan with antivirus software on your device
2. Back up your data
3. Before 12:00 on October 27, after backing up, disconnect from the network, power off, and unplug the cables connected to the PC
4. Protect your accounts (from a separate, safe device; see the 6th notice for steps)

The third item is new. The 8th notice was partly corrected at 10:56, and it says the correction was to this item. We have not seen the text before the correction.

The 8th and 9th notices do not say why powering off is requested.

##Device analysis (9th notice)

GMO’s white-hacker team is analyzing the devices collected from users, one after another. The 9th notice (as of 11:59) says:

• No malware, including ransomware, has been found on the devices whose analysis is finished
• Analysis is still going on, and this does not confirm that every user’s device is safe
• More devices are still expected to arrive

“Not found” is different from “confirmed safe.” Only some of the collected devices have been analyzed. That is as far as this can be read.

GMO has not disclosed the entry route or cause, as of the 9th notice. The RDP drive-redirection findings in our earlier post (2) come from lab measurements and the attacker’s claims, and are separate from this analysis.

##If you are hit by ransomware

The 9th notice adds a new offer. Users hit by ransomware contact the support desk. GMO checks the damage and provides a new PC with performance equivalent to the affected one.

The support desk is the form (https://help.onamae.com/contact/) and phone 03-5456-2560 (24 hours, including weekends and holidays), as listed in the 6th and 7th notices.

The 9th notice does not give conditions or procedures. Ask the desk before you apply.

##Help from other companies

The 8th notice says security companies such as Trend Micro, and AI companies, have offered to help. The 10:56 correction added the company name. The notice says the details of that cooperation are being “confirmed and coordinated,” not that anything is decided.

##What to do today

12:00 has passed. Through the 9th notice, no instructions have been given for after the deadline. It does not say whether or when you can power your PC back on. Wait for GMO’s email and notices.

The advice in our earlier posts still stands.

• Change your passwords from a device you do not use for FX, and turn on two-factor authentication (post 3)
• Do not answer anyone claiming to be GMO who asks for passwords or authentication codes. Ignore messages asking for fees to “recover lost funds.” The 6th to 9th notices repeat that GMO will never ask for your password or authentication code
• If someone claiming to be the attacker contacts you: do not open it, do not reply, do not pay, and do not send files

##What is still unknown

• Whether the attack or publication happened as warned at 12:00. The 9th notice is as of 11:59, before that time
• Updates to the attacker’s site on October 27. News reports say a statement was posted at noon. We did not connect to the attacker’s site and have not confirmed this. We do not cover anything that could identify individuals, whether or not it is confirmed
• The analysis results: how many devices are done is not stated in the 9th notice
• The entry route and cause (not disclosed through the 9th notice)
• What the government has actually done (still unconfirmed, as in the earlier post)