Daily Cyber Threat Brief — October 22, 2026: Onamae Desktop Cloud Breach Hits Up to 27,000 Servers

Supply-chain breaches are bad; a cloud provider breach is worse, because every tenant inherits the provider's compromise. Onamae.com Desktop Cloud byGMO is marketed for stable always-on workloads like FX automated trading on MetaTrader 4 — workloads where a sudden mass shutdown is catastrophic. GMO detected the intrusion, shut every customer's server down, and still cannot say when service returns. That is the defender reality of shared infrastructure: you can harden your own VM all you want, but your uptime and your secrets live on someone else's control plane.

What investigators will be looking at: the initial access vector into GMO's management layer, whether the "malicious programs" included persistence or credential harvesting, and how far tenant isolation actually held. For customers, the immediate playbook is credential rotation of anything that lived on those servers, phishing vigilance — GMO explicitly warned of impersonation attempts — and restoring from clean backups onto known-good infrastructure once service resumes. The fact that payment card data stayed safe only because it lives on separate infrastructure is a quiet endorsement of segmentation done right.

Interpol's Operation Serengeti III — 21 countries, June 29 to August 31 — is one of the largest coordinated African cybercrime operations on record: 10,909 malicious networks dismantled, 1,462 suspects arrested, 65,929 victims identified, estimated losses of $385 million, and more than $105 million in illegal funds recovered. The focus: business email compromise, ransomware and online scams.

The highlights read like a tour of the regional fraud economy: two transnational fraud rings dismantled in Uganda (365 arrests, investment and pension fraud), illegal cryptocurrency mining centers in Angola (nine suspects, 2,000+ mining devices seized), and a single Nigerian suspect allegedly behind a phishing and BEC operation that harvested 2.1 million email addresses. Private partners — Team Cymru, Kaspersky, Group-IB, Fortinet — supplied the intelligence layer: suspicious domains, IPs and C2 infrastructure. The scale of the victim count is the signal here; a single operation touching 65,929 victims says the criminal infrastructure in the region was industrialized, not artisanal. Arrests don't end the model, but seizing the money and the miners raises the cost of rebuilding it.

Kaspersky's GReAT team has attributed a campaign dubbed FlashHole to North Korea's Lazarus Group, active since at least July 2025 against at least three South Korean organizations in software, construction and wire-communications equipment manufacturing — with more victims suspected. The headline finding: an updated version of the LPEClient backdoor uses ML-KEM-1024, the standardized post-quantum key-exchange mechanism, to establish its encrypted C2 channel before downloading and executing payloads in memory. Lazarus has been experimenting with post-quantum cryptography in its malware since at least September 2024.

The tradecraft is a blend of old and new. Initial access came through targeted phishing emails pointing to AI-generated fraudulent CV and portfolio websites — Kaspersky found indications that neural networks were used to generate profile photos and tailor the lure pages to individual targets, an evolution of the group's DreamJob playbook. The infection chain then ran through private GitHub repositories: phishing pages loading external JavaScript, abuse of INISAFE CrossWeb EX — a security tool ubiquitous in South Korea — to proxy execution of shellcode via the legitimate fsquirt.exe binary, a TechHub downloader pulling malware from GitHub, two previously undocumented tools (TouchHub, ClientHub — the latter with Dropbox C2 support), and the Cubridge modular backdoor for file management, command execution, reconnaissance and screenshots, plus Chromium-browser credential harvesting.

The post-quantum angle is about the long game: even if C2 traffic is captured today, it stays opaque against future quantum decryption — protecting both the operation and the intelligence value of anything exfiltrated. For defenders, the lesson is that PQC adoption is not only a defensive migration; well-resourced adversaries are already on it. Detection here has to live in the process chain (trusted-tool proxying, in-memory execution, Dropbox egress from odd processes), not in decrypting the traffic.

CISA has confirmed active exploitation of Plex2Shell — four chained flaws in Plex Media Server (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656) that together yield unauthenticated remote code execution with the owner's admin token — and added all four to the KEV catalog. Researcher boredhackerblog observed exploitation against honeypots from October 17 deploying cryptominers and proxy malware; Plex says the flaws are being "actively and widely exploited." The fix (1.43.3.10861) shipped August 3 — so any internet-reachable server still on an older build has had a known-exploitable chain for nearly three months.

CISA directed federal agencies to patch or mitigate the two more severe CVEs by October 23 (the other two by November 3). The same KEV update added CVE-2026-110936, a DLL-sideloading flaw in Siemens Software Center abused in ClickFix attacks via the Romulus delivery platform, and CVE-2026-106931, a command-injection bug in EG Secure Solutions' SiteGuard Server Edition that the Japanese vendor confirmed is being exploited. Plex's own guidance is blunt: if a server was reachable from the internet on an old build at any point since mid-October, patch it and check it — look for unfamiliar processes, unexpected Codecs files, odd outbound connections and unexplained CPU spikes, and treat mounted shares and stored credentials on a possibly-compromised box as exposed.