Anime, manga, and games, with a take · A Yukimedia publication

GMO Unauthorized Access Viewer Mirrors Threats Without Feeding Tracker

Satoru Yano, the developer behind Open 2channel, published a viewer that collects the threatening messages posted by the person believed to have attacked GMO Internet Group's Onamae.com Desktop Cloud and sets them beside GMO's own announcements.

Reporting from 1 source: GIGAZINE.

Why it matters

The mirror keeps the extortion text on the record while skipping the tracker on the original page, so the threat stays readable without logging more visitors for whoever posted it.

GMO Unauthorized Access Viewer Mirrors Threats Without Feeding Tracker

Key Facts

  • Satoru Yano published a viewer that pairs the attacker's threatening messages with GMO's official announcements on the Onamae.com Desktop Cloud access incident.
  • GMO Internet Group says the number of potentially affected servers is 26,739, and information stored on them may have been viewed.
  • Yano warned that the attacker's page carries a 1x1 tracking beacon that records a visitor's IP address and environment.
  • GMO advised customers to back up, disconnect from the network, power off and unplug cables after notice of a ransomware attack set for 12:00 on Tuesday, October 27.

GMO puts the number of potentially affected servers at 26,739. The attacker gave notice of a ransomware attack set for 12:00 on Tuesday, October 27, and GMO told customers to back up, disconnect, power off, and unplug.

The attacker's extortion page embeds a 1x1 tracking beacon, track.php, that logs a visitor's IP address and environment on the attacker's side. The mirror does not fetch it.

Whether the claimed damage happened is unresolved. The person believed to be the attacker says customer names were exposed and money taken from accounts. GMO has not publicly confirmed either. GMO's own figure is 26,739 potentially affected servers, with stored information possibly viewed.

GMO received notice that customer information would be disclosed and a ransomware attack carried out at 12:00 on Tuesday, October 27. Its advice to customers: back up, disconnect from the network, power off, unplug the cables. Yano also posted an analysis of a samples.zip file the perpetrator published.

Written with AI by Yomimono from the 1 cited source below, including Japanese-language reporting where cited. See our editorial policy.

Add Yomimono as a preferred source on Google

Sources