Skip to content
Ferroscope
Menu
criticalHostingactive22 Oct 2026

Onamae

Malware planted on up to 26,739 customer servers in Japan

What happened

Attackers compromised the hosting provider's control plane and pushed malicious code to as many as 26,739 customer servers. Control-plane trust turned into mass remote execution.

Timeline

  1. 22 Oct 2026 · 07:40 UTC

    Discovery

    Customers report unexpected processes on managed servers.
  2. 22 Oct 2026 · 15:20 UTC

    Scope

    Up to 26,739 servers are believed to have received the payload.
  3. 23 Oct 2026 · 03:00 UTC

    Rebuild guidance

    The provider tells customers to rebuild from clean images, not clean in place.

Sources