Japan's GMO Internet Group Warns Customers to Shut Down PCs Amid Active Ransomware Threat

What Happened

According to BleepingComputer, Japan's GMO Group has urged customers to disconnect their systems from the internet and shut down their computers. The company gave this advice after a threat actor breached its Onamae Desktop Cloud service and threatened to launch a ransomware attack that day. The report is still developing. Full details on the intrusion vector, the scope of the breach, and the identity of the threat actor have not been disclosed.

Why It Matters

GMO issued a public instruction to physically disconnect and power down endpoints. That step suggests the company treats the threat as serious. The source does not describe the structure of the Onamae Desktop Cloud service or confirm any impact beyond GMO itself.

Who May Be Affected

• Customers of GMO's Onamae Desktop Cloud service

What Defenders Should Watch For

No CVE, malware family, or technique details have been confirmed. Defenders who use GMO services should focus on general ransomware hygiene and hunting rather than a specific indicator set:

• Review and, where appropriate, restrict remote access such as RDP, VPN, and cloud desktop connections to and from GMO-hosted infrastructure until more is known
• Hunt for unusual authentication activity, new remote-management tooling, or unexpected outbound connections on endpoints that interact with Onamae Desktop Cloud
• Check backup integrity and offline or immutable backup coverage now, before any confirmed impact
• Watch for mass file-modification or encryption alerts, such as high-volume renames or shadow-copy deletion attempts
• Monitor official GMO communications and JPCERT advisories for updates

Developing Story

Limited technical detail is available at publication time. No confirmed CVE, malware family, or attacker attribution has been reported. For the latest details, see the original report from BleepingComputer.