Why did the attacker publish their own evidence? The Onamae.com Desktop Cloud incident, traced through primary sources

On October 19, 2026, GMO Internet Group started an investigation into “Onamae.com Desktop Cloud,” a cloud Windows service that was used to run automated FX trading. Users’ trading accounts showed trades they did not make.

This incident differs from an ordinary data breach in one way: the person who appears to be the attacker published “evidence” on their own site. The site has beacon source code, an Excel list of accounts, access logs, and screenshots of emails. We did not steal any of it. The other side put it out, so we can trace it.

This article is a record of re-reading those published files as primary sources. The first half follows the infrastructure and the second half checks the contents. We sort every number into one of four categories: official, claimed, confirmed by us, and unconfirmed.

##What happened

This section is built only from GMO’s official announcements. All times are Japan Standard Time.

GMO has acknowledged that the apparent attacker demanded money. The amount, US$50 million (about ¥8 billion), was published in the October 26 update to the CEO’s blog. GMO has not published a deadline. It has also said plainly that it will not comply. The goodwill payment is a flat ¥5,000 for every current user. Realized losses from unauthorized trades will be compensated. Users who move to a replacement service get 6 months free. All of this is official.

##What the attacker site contains and how it is organized

The site is titled “通告 — onamae.com desktop cloud” (“Notice”). Besides the top page, it had four subpages. We read all of them from archived copies and did not connect to the live site.

The structure shows one item at a time: statement, timeline, evidence, plans, list. It looks like a reading room built to gain leverage in a negotiation. The numbers do not agree across pages, though (see below).

##Infrastructure: WHOIS, TLS, subdomains

We looked only at public metadata and did not touch the site. We withhold the domain and IP in this article, to avoid steering readers to the site or causing accidental connections.

The certificate’s SAN contains only the domain and www, so no other site shows up from the same certificate. We found no subdomains other than www. The IP belongs to a shared server and is not the attacker’s. No person can be identified from it.

A certificate 17 minutes after registration is consistent with a rushed setup, but we can say nothing beyond that. The registrant is not public, so it is no basis for nationality or location.

##Comments in the site and language analysis

The archived HTML and CSS contained comments that were not shown on screen. This part shows the hand of whoever built the site.

The CSS comments are in fluent Japanese, with some English such as accounts panel, header, and layout mixed in. The body text, on the other hand, has broken phrases such as 「約 74 億万円」, 「各アドレスにずつ」, and 「返答えなかった」 (all quoted as in the original; the Japanese is garbled, and roughly they read “about 7.4 billion ten-thousand yen,” “to each address, each,” and “did not reply-ed”).

All we can say is that the code comments and the body text were written in different processes. “The Japanese is fluent, so the author is Japanese” and “it reads like machine translation, so the author is Chinese” are both unsupported. Language is not evidence of nationality.

##Site versions and the beacon

The archived copies show 6 versions. The numbers and the presence of the beacon change from version to version.

15% became 17% and ¥6.6 billion became ¥7.7 billion. Midway the numbers vanished from the screen and moved into comments, and finally the beacon was removed. The beacon existed, and it was removed. We confirmed this from the actual versions.

The “US$1 million” in v5 and v6 differs by a large factor from the demand GMO published (US$50 million). The site’s text alone does not settle which amount refers to what.

##The published source.zip

The top page hosted source.zip: 1,354,131 bytes, 48 entries.

The SHA-256 of the file we fetched again matched our record from October 26, 2026. It is the same file. From here we read the code and data inside it.

##Contents 1: What the beacon recorded

track.php pretends to return a 1×1 image while recording the time, IP, IP hash, bot determination, page name, User-Agent, and Referer. Two points here are hard to overlook.

The salt is still the default

The hash is the first 16 hex digits of SHA-256, and the salt is known. Brute force can recover the original IP. Hashing does not make it safe.

The IP can be spoofed with headers

client_ip() trusts CF-Connecting-IP, X-Forwarded-For, X-Real-IP, and REMOTE_ADDR, in that order. So anyone who sets a header can change the IP that gets recorded.

1,379 does not mean 1,379 people looked. IPs are shared and can be spoofed. It is the number of unique hashes, and we can say nothing more.

Still, that is 3,555 hits in about 20 hours. The beacon is only on the top page, and almost every page was index. The attacker ended up publishing their own visit log.

##Contents 2: The account list has 1,260 entries

The metadata of accounts.xlsx was as follows. We did not read any cell values.

accounts-2.xlsx has 472 rows and 1,888 cells. Adding the two and subtracting the 2 header rows gives 1,260 entries.

WPS Sheets and 工作表 show that the file was made with Chinese-made office software. We still cannot say anything about nationality. Evidence about an environment is separate from a person’s nationality.

##The claimed breakdown of “destroyed” accounts

The attacker claims to have “destroyed 17% of 140,000 accounts.” We lay out that breakdown using only the numbers written on the site. This is a claim, not something we confirmed.

We cannot give a breakdown by brokerage. We did not read the cell values of the account list (PII). All we know is the percentages the attacker claimed and the row count of the published list. Mixing these would read as if we had confirmed “a breakdown of 23,800 people.”

##Email images and metadata

emails.php had 25 Gmail screenshots. There are no .eml or .msg files, so SMTP headers cannot be analyzed.

We did not obtain the sender’s email address. From the header area at the top of each image we OCR’d only the date and time. We did not read recipients, senders, or body text, because victims’ or third parties’ addresses may appear. We therefore do not publish them here either.

What we can say is the structure from the HTML comment (“notices: 3,” “progress updates: 22” = 25 images) and the displayed times. mail-01 shows Oct 21 2:55 AM and mail-02 shows 5:07 AM.

Gmail displays times in the viewer’s own time zone, so the images alone do not settle what time it was in Japan. Read as UTC, they are 11:55 and 14:07, close to the “URL sent at 11:55” in timeline.php and the time GMO gave for the demand document (11:57). Read as US Central daylight time (UTC−5), they are 16:55 and 19:07, which fits the body text of mail-01, “from 17:00 today.” We choose neither, because we do not have the original headers. We cover this in more detail in article (2). The time zone can be changed in settings, so neither reading is evidence of location.

For the metadata, the xlsx files show WPS Sheets, 工作表, Logitech, 790 rows / 3,160 cells (the second: 472 rows / 1,888 cells). The email images are RGBA 8-bit and carry no software name or DPI information.

##The numbers: 4,352 and ¥7.7 billion

This incident was one where numbers easily took on a life of their own. We sort them out first.

26,739 is a count of servers, not of victims. It is more than 20 times the size of the published list (1,260 entries), but the actual number of victims has not been published. GMO itself notes that it is “not the number of cases where unauthorized access or information theft was confirmed,” so we follow the official statement.

The attacker says “about ¥7.7 billion in 24 hours.” The same site also has a figure of ¥4.2 billion. They do not agree. We have not summed the balances in the published list, because we did not read the cell values.

Why? The attacker claims a total balance of US$280 million. 17 percent of that is about US$47.6 million, about ¥7.5 billion at the rate at the time. That is a figure back-calculated from a percentage, not the actual total of the accounts. We are not saying flatly that “¥7.7 billion is a lie.” The point is only that the numbers within the site do not agree with each other.

##Users’ PCs and the .rdp file

The site had one more published file: samples.zip, work logs from reading 10 users’ PCs. We split its summary, plus the lab tests of RDP drive redirection and DPAPI, into article (2). How to read the .rdp file the attacker showed as proof of “GMO’s negligence,” and what users should do, are in article (3).

##Legal framework: a request is not an activation

In its 4th notice on October 24, GMO announced that it had asked the government (a formal recommendation) to apply active cyber defense. In the CEO’s blog the next day, GMO explained that it made the recommendation while understanding two points raised publicly: that it is not a designated critical infrastructure operator, and that the measure is not something the government acts on at a private company’s request but something the government decides on its own initiative. The Cabinet Office list, as of July 2026, covers 15 sectors and 258 companies. GMO is not on it.

So talk such as “they asked, so the government should move” or “it is wrong that the government did not move” starts from the wrong premise about the system. A request and an activation are separate things. What measures the government actually took is unconfirmed.

##Unconfirmed

• The claim that distributed .rdp files contained drivestoredirect:s:* by default. This is the attacker’s claim, and GMO’s announcements do not mention it. We have not confirmed it either
• Which line the standard Windows connection software uses when drivestoredirect appears twice. FreeRDP uses the later line (article (3))
• The intrusion route. On their own site the attacker claims that “the VPS group was connected in a single Active Directory environment, and it was possible to move from one VPS to another.” It also claims that one admin-level account worked on every VPS, and that when a support engineer connected to a customer’s PC, the customer could pull that account’s credentials (post of Oct 24). Both are the attacker’s claims; GMO has not addressed them and we could not confirm them. GMO says it is investigating the route and has not published a cause (through the 6th notice)
• The attacker’s location. Neither time zone nor language is evidence of nationality
• The government’s actual measures

##Analysis notes

From here on this is our reading, not fact. We do not assert it.

Why publish their own evidence? The natural reading is to gain leverage in the negotiation. Showing the account list and emails makes people believe “they really have it.” In fact, they added the demand amount and a deadline later. The motive is unknown, though. It is also too early to assume money was the goal.

Why the numbers do not agree. On the same site, ¥7.7 billion, ¥7.4 billion, ¥6.6 billion, and ¥4.2 billion are mixed together, and “85% remaining” and “83% remaining” sit on the same page. Exaggeration, mixed tools, and machine translation are all possible. Still, internally contradictory numbers cannot be treated as fact. This is a fact that works against the other side.

The word “destruction.” Did they delete data, or take over accounts and make unauthorized trades? The site’s wording alone does not settle it. GMO’s 4th notice describes the content of the threat as “damage to account balances through unauthorized orders.” Reading it as reducing balances through unauthorized trades, not deleting data, is consistent with the official account. Mixing the two gets the nature of the damage wrong.

The infrastructure is crude. Shared hosting, a default salt, a certificate 17 minutes after registration, a hidden WHOIS. They meant to hide, but the build is rough. The damage is large anyway because the entry point was weak: RDP drive redirection, reused passwords, and no multi-factor authentication. We lose on our own settings, not on the attacker’s skill.

Language analysis is not about nationality. The comments are fluent Japanese and the body reads like machine translation. The most we can say is that the processes differ. Tying this to nationality would hurt people who have nothing to do with the incident.

This is as far as we can go. Identifying an individual takes provider logs and a criminal investigation. What public information can do is draw the line between “this much is known” and “beyond this is not known.” An article that does not draw that line is the most dangerous kind.

##IoC

These are values for reproduction and matching. We do not list domains or IPs (to avoid steering readers or causing accidental connections).

##Summary

This incident was not about whether to believe or doubt a roundup. Going down to the primary sources and re-reading the published evidence changes what the numbers mean.

1. 26,739 is not a count of victims. It is the number of servers that could be affected
2. 1,260 entries in the account list, 4,352 copies ((2)), and 3,555 hits are three different numbers
3. ¥7.7 billion is a back-calculation from a percentage, and it does not agree with other numbers on the site. That unauthorized trades occurred, however, is officially acknowledged by GMO
4. Turn off RDP redirection. Both reading and writing are possible (lab test in (2))

##What to do now

The steps are in article (3). Here are only the key points.

1. Change the passwords for your trading account and trading tools from a device you have not used for FX trading, and turn on two-step verification
2. Do not double-click any .rdp file you have. Open it in Notepad and check every drivestoredirect line
3. Do not open emails from someone claiming to be the attacker, do not reply, do not pay, and do not send files