GMO Desktop Cloud Leak: Checking RDP Drive Redirection on Local PCs
Contents
TL;DR
What happened The attackers threatened to publish customer records and launch ransomware attacks at noon on October 27. GMO confirmed at 12:30 that data purportedly related to customers had appeared online. As of 13:55, no ransomware damage has been confirmed across customer environments.
Why stay off the leak site GMO confirmed that visitor IP addresses and connection logs on the leak site are being harvested by the attackers, urging users not to visit or share links. Because the site exposes real personal records, this article omits the site name and URLs to prevent secondary harm.
Checking your local PC The attackers claim GMO’s distributed connection profiles had local drive redirection enabled by default. GMO has not verified this vector, and forensic analysis of affected customer devices found no malware as of 11:59.
Following the unauthorized access to Onamae.com Desktop Cloud, attackers began releasing purported customer data shortly after their announced deadline of noon on October 27, prompting GMO to issue multiple advisories regarding network isolation and forensic progress.
GMO had previously sought government intervention under active cyber defense legislation, as discussed in Can Japan’s New Active Cyber Defense Law Help GMO’s Hacked FX Trading Customers?.
While the attackers claim they can pivot to local client PCs via preconfigured RDP connection files, official bulletins diverge from these claims as of 16:00 on October 27.
Timeline of October 27
The attackers had warned that they would publish customer records and deploy ransomware on Tuesday, October 27, at 12:00.
GMO disclosed this warning on the night of October 26 in Bulletin 7, followed by four updates (Bulletins 8 through 11) by 15:00 on October 27 (Bulletin 7).
| Time | Advisory | Details |
|---|---|---|
| Oct 26, 21:00 | Bulletin 6 | Urged users to perform full device scans, make offline backups, and secure account credentials |
| Oct 26, 23:10 | Bulletin 7 | Disclosed the noon deadline and began analyzing machines from users who suspected unauthorized actions |
| Oct 27, 09:58 | Bulletin 8 | Urged users to back up data, disconnect networks, power down PCs, and unplug cables before noon. Trend Micro joined assistance efforts |
| Oct 27, 11:59 | Bulletin 9 | Confirmed no malware or ransomware found on analyzed client PCs so far; device analysis continues |
| Oct 27, 12:30 | Bulletin 10 | Confirmed suspected attacker began publishing data reportedly tied to GMO and its customers |
| Oct 27, 13:55 | Bulletin 10 | No ransomware incidents confirmed across customer environments |
| Oct 27, 14:55 | Bulletin 11 | Requested halt to data sharing; announced preparation of legal actions against malicious distributors |
In Bulletin 9, GMO announced that users suffering ransomware damage would be provided with replacement PCs of equivalent performance upon inquiry.
GMO stated it will not yield to extortion and noted that paying demands offers no guarantee of data deletion or prevention of misuse (Bulletin 8).
The extortion email received on October 21 had demanded approximately 8 billion yen.
Status of Leaked Information
According to Nikkei, the attacker posted the name and address of one customer on their website and promised sequential releases each day at noon (Nikkei).
ITmedia NEWS similarly reported that the published record appeared to be one individual customer’s personal information (ITmedia NEWS).
Whether the published information is genuine or originated from GMO has not been independently verified.
GMO stated that it is investigating the contents and warned that unverified releases may include inaccuracies (Bulletin 10).
According to Security Measures Lab, the attacker claimed that records would be released daily as analysis concludes, a process the group claims will take several years.
However, there is no independent evidence indicating the total volume of data in the attacker’s possession (Security Measures Lab).
GMO plans to notify individual customers if their personal details are confirmed within the leaked data.
For those affected, additional condolence payments are under consideration beyond the blanket 5,000 yen offered to all customers (Bulletin 10, Nikkei).
Risks of Accessing the Leak Site
GMO repeatedly warned in Bulletins 10 and 11 against accessing the leak site or circulating its contents.
The company confirmed that visitors’ details are being harvested by the site operator (Bulletin 11).
Specific indicators regarding what data is collected have not been disclosed.
GMO advises users who have already visited the site to run full antivirus scans on their devices.
The hazard extends beyond visitor endpoint security.
Because the published data contains real names and addresses, higher traffic directly accelerates secondary exposure of victims.
GMO announced it is preserving evidence to pursue civil disclosure requests and criminal complaints against malicious distributors (Bulletin 11).
Bulletin 10 also called upon media organizations to exercise restraint to prevent secondary harm to customers (Bulletin 10).
Attack Vector: Pivoting to Client PCs via RDP
Desktop Cloud leases Windows virtual servers hosted in GMO’s data centers, which customers manage from their local PCs via Remote Desktop Protocol (RDP).
If only the virtual server were compromised, damage would ordinarily stay contained within the remote environment.
Yet the attackers threatened ransomware against local client PCs, and GMO advised customers to power off their machines.
The attackers point to RDP drive redirection as the mechanism, alleging that connection profiles (.rdp files) distributed by GMO had client drive redirection enabled by default.
Under this assumption, connecting to a compromised virtual machine would grant the remote server read and write access to local files (HOKKAIDO AI LAB).
Scope of Local Access via Drive Redirection
Drive redirection exposes local storage volumes (such as C: drives and connected USB drives) to the remote Windows host session.
An .rdp file specifies connection addresses, display settings, and client device sharing rules.
Drive sharing behavior is controlled by the drivestoredirect setting (Microsoft Learn).
drivestoredirect Value | Shared Drives |
|---|---|
| Empty (not set) | Do not share (default) |
* | All drives, including USB media attached during the session |
DynamicDrives | Drives attached after establishing the connection |
List of drive letters like C:\;E:\; | Only specified volumes |
Microsoft identifies drive redirection as one of the most security-sensitive RDP features (Microsoft Learn).
When enabled, the remote machine can read and write files on the local file system.
If the remote host is controlled by attackers, sensitive local documents and saved credentials can be extracted.
Attackers could also write malicious payloads into the local startup folder (which executes programs automatically upon login) or access network shares reachable from the client.
The advisory urging users to power off PCs prior to noon was likely intended to prevent scheduled execution of payloads potentially staged across shared drives.
However, GMO has not published technical details explaining the reasoning behind the shutdown request.
Protection Changes in Microsoft’s April 2026 Update
Microsoft modified how the standard Windows Remote Desktop Connection app handles .rdp files in its April 2026 security update.
Following this update, opening an .rdp file displays a confirmation prompt prior to connecting.
The prompt lists the destination address alongside device sharing checkboxes, all unchecked by default (Microsoft Learn).
This behavior was introduced to mitigate attacks where malicious .rdp files distributed via phishing lured victims into exposing local storage.
This verification prompt applies exclusively to connections launched from .rdp files; connecting by typing a host name directly into mstsc.exe bypasses this prompt.
Consequently, even on updated systems, drives could still be redirected if a user manually checked drive sharing boxes or configured sessions directly within the client app.
Attacker Claims and Verification Status
Since October 24, the attackers have posted multiple statements detailing their intrusion.
While these claims circulated across media and blogs, none have been confirmed by GMO (Security Measures Lab, Offtrack Notes).
| Attacker Claim | GMO Statement | Verification Status |
|---|---|---|
Distributed .rdp files shared all local drives by default | Attack vector not disclosed | Original distributed files not independently verified |
| Default drive sharing had been active since 2019 | No mention | No historical configuration records confirm this |
| Virtual servers were domain-joined in Active Directory with shared administrative credentials across machines | No mention | Unverified |
| Published file-copy logs from 6 customer PCs (totaling 3,566 rows per Security Measures Lab) | Investigating potential impact on customer endpoints (Bulletin 5) | Authenticity and exfiltration proof unconfirmed |
| Data will be published daily at noon, taking years to complete | Released data may contain inaccuracies | Total data volume unverified |
GMO has officially acknowledged only that vulnerabilities led to unauthorized intrusion and customer data exfiltration (Bulletin 4).
While GMO listed 26,739 servers as potentially affected in Bulletin 4, it clarified that this is not the confirmed number of breached machines.
Furthermore, whether the group posting statements is the actual entity that breached the network has not been independently established (Security Measures Lab).
How to Check and Secure Your Local PC
GMO instructed customers to execute full endpoint scans, create offline backups on disconnected external storage, and protect account credentials (Bulletin 6).
Quick scans are insufficient; GMO instructs users to run a full scan across all storage volumes.
Account protection steps include resetting passwords for FX trading, brokerages, email, and Google from a clean device, terminating active sessions, and enabling multi-factor authentication (MFA).
Users should also remove unrecognized browser extensions, OAuth application authorizations, and email forwarding rules while pausing browser profile sync.
Drive sharing settings can be inspected directly within saved .rdp files.
Because double-clicking launches a connection, right-click the file and select “Open with Notepad,” then check the drivestoredirect:s: line.
If the value is *, all drives are shared. If the value is empty or the line is absent, drive sharing is disabled. To turn off sharing, either delete this line or set it to drivestoredirect:s: and save the file.
If connecting without an .rdp file, open Remote Desktop Connection, click “Show Options,” go to the “Local Resources” tab, click “More,” and ensure all drive checkboxes are cleared.
Having drive redirection enabled does not mean a client PC is compromised.
Even if a file were deposited into a shared folder, executable code cannot run without an execution trigger on the client.
In GMO’s forensics, analyzed customer machines have shown no traces of malware (Bulletin 9).