Onamae Desktop Cloud Breach Hits Up to 27,000 Japanese VPS Customers

What happened

According to BleepingComputer, attackers compromised the infrastructure of Onamae Desktop Cloud, a popular Japanese VPS (virtual private server) provider, and installed malware on as many as 26,739 customer servers. Details on the initial access vector, the malware family involved, and attribution have not yet been disclosed.

Why it matters

VPS providers sit at a high-leverage point in the supply chain: a single compromise at the hosting layer can translate into malware deployed across tens of thousands of independently-owned servers at once. Any organization or individual running infrastructure on Onamae Desktop Cloud should treat their instances as potentially compromised until the provider confirms otherwise, regardless of what workloads were running on them.

What defenders should do now

• If you operate a server on Onamae Desktop Cloud, check for official provider notifications and guidance before assuming your instance is clean.
• Review server logs for unexpected processes, new scheduled tasks/cron jobs, unfamiliar outbound connections, or unauthorized SSH/RDP access around the incident timeframe.
• Audit for new or modified user accounts, SSH authorized_keys changes, and unexpected binaries in startup paths.
• Rotate credentials and API keys that were stored on or accessible from affected servers, out of caution.
• Watch threat intel feeds for IOCs (hashes, C2 infrastructure) as the vendor or researchers publish more detail on the malware used.

Developing story

This is a net-new, developing report with limited technical detail published so far — no CVE, malware family, or root cause has been confirmed at the time of writing. We will track this story for updates. Read the original report at BleepingComputer.