Hackers Planted Malware on Japanese Cloud Servers, Forcing the Provider to Shut Down Its Service

Hackers planted malware in customer server environments at Japan’s Onamae.com Desktop Cloud, prompting the provider to begin shutting down servers across every service plan.

The company listed 26,739 servers as potentially affected, raising concerns about stored data and login details. That figure describes the possible scope, not a confirmed count of infected systems.

The provider confirmed the malicious programs on October 20, 2026, and began stopping customer servers from 4:00 a.m. Japan time on October 21.

Its official incident notice said the shutdown aimed to prevent further damage. The notice gave no restart date, leaving customers without access while the investigation continued.

Onamae identified the malware in some customer server environments and warned that information held inside those systems may have been viewed.

However, its public findings do not name the malware, explain its functions, or describe how the attackers first gained access. The disclosure confirms an intrusion but leaves the attack chain unresolved.

Hackers Planted Malware on Japanese Cloud Servers, Forcing the Provider

The shutdown covers all Onamae.com Desktop Cloud plans, rather than only the servers where malicious programs were confirmed. Customers cannot use the service while their servers are stopped.

The response recalls the ShareFile emergency server shutdown warning, although that separate case involved a precautionary response to a threat rather than this confirmed malware discovery.

For customers, the immediate problem combines lost access with uncertainty about information stored on their rented servers. Onamae has not publicly identified the affected files, accounts, or applications.

It also has not said whether attackers copied data elsewhere. Possible viewing of information should therefore not be reported as confirmed data theft.

The company said it had found no confirmed leak of the customer personal information it holds, and no confirmed misuse of information that may have been viewed.

It separately stated that it does not retain payment information, including credit card details. These statements do not remove the warning about data inside customer servers.

Technical Details Remain Limited

Onamae has not disclosed an entry point, a security flaw, or a named attacker. Its notice also does not establish whether the malicious programs stole passwords, opened remote access, or performed another task.

Calling the incident ransomware, a supply chain attack, or a campaign by a known group would go beyond the available evidence.

Cloud malware can target secrets stored within hosted systems. In a separate case, reporting on cloud server credential theft described malware built to collect cloud access details.

That example explains the wider concern around server compromise, but it provides no evidence that the same tools or attackers were involved at Onamae.

The provider’s request to change login details makes credential exposure an immediate concern, even without a published malware analysis.

It specifically asked customers to change authentication information stored or used on the servers. That instruction covers a potential route to further account access, not proof that every saved password was stolen.

Users should follow Onamae’s instruction to replace exposed login details promptly and change matching passwords on other services.

The separate ConnectWise backup credential breach showed how a compromised vendor secret enabled unauthorized access across customer environments. The comparison highlights why access details matter; it does not establish how this incident began.

Onamae also warned about phishing emails and suspicious messages exploiting the incident. The company said it would never request passwords or credit card information by email or telephone.

Customers facing an outage should treat such requests with care, especially when a message claims that sharing account information is necessary to restore access.

Security-themed messages can themselves become an entry point. Reporting on passkey themed phishing attacks described criminals posing as support staff to capture cloud access.

Onamae’s warning is preventive: its notice does not confirm that a related phishing campaign has already targeted customers.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Hackers Planted Malware on Japanese Cloud Servers, Forcing the Provider to Shut Down Its Service appeared first on Cyber Security News.