TOKYO (TR) – A shadowy website aimed at rallying victims of a recent cyber attack targeting Japanese tech titan GMO Internet Group was registered before the breach was even made public, a cybersecurity firm has revealed, reports NHK (Nov. 1).
According to Tokyo-based security firm S&J, the now-defunct website called on individuals impacted by the unauthorized access to GMO Internet Group to come forward and “share information.”
Shortly after the security breach came to light, a flurry of suspicious social media accounts repeatedly blasted links directing victims to the portal.
A forensic analysis conducted by S&J revealed that the rogue domain was registered on October 19 — two days before GMO publicly acknowledged the breach on October 21.
Investigators also discovered that the site was hosted on the same U.S.-based server that the hackers had previously used to post extortion threats against the company, sharing glaring structural and technical similarities.
The findings strongly suggest that the portal and the social media accounts promoting it were orchestrated directly by the cyber criminals behind the attack.
Nobuo Miwa, president of S&J, indicated that the site was likely a calculated maneuver designed to ratchet up extortion pressure.
“A site like this isn’t necessary if you’re only making ransom demands or negotiating,” Miwa said. “The attackers likely launched it to organize the victims and amplify pressure on the company. Examining the digital breadcrumbs and communication logs could lead to the identification of the attackers.”
GMO will hold a press conference on Monday, with chairman Masatoshi Kumagai providing an update on the unauthorized access.
