Tech News, October 23: Japan’s Cloud Provider Hacked, PingCAP’s Breach, Lazarus Goes Post-Quantum, and OpenAI Lands on Google Cloud

Five stories moved the tech world in the last day: a Japanese cloud provider shut down up to 26,739 customer servers after a hack, a major database vendor disclosed a month-long breach, North Korea’s Lazarus Group was caught using post-quantum encryption, OpenAI’s models landed on rival Google Cloud, and Interpol announced its largest Africa cybercrime sweep yet.

1. Onamae Desktop Cloud hacked, up to 26,739 servers shut down

Hackers compromised the infrastructure of Onamae Desktop Cloud, a Japanese VPS service run by GMO Internet, and installed malicious programs in customer environments. The company confirmed the intrusion on October 20 and began progressively shutting down customer servers at 04:00 local time on October 21. All Desktop Cloud plans are suspended, and GMO has given no restart date.

The scale is what stands out: up to 26,739 customer servers may be affected. The service is widely used to run MetaTrader 4 automated foreign-exchange trading bots, which makes the compromise especially sensitive — trading credentials and API keys stored on those servers may have been viewed. GMO says payment information is stored on separate infrastructure and was not affected, and it has not confirmed any actual misuse of the exposed data.

Why it matters: this is a hosting-trust incident, not a customer-hygiene one. If you rented one of these servers, rotate every secret that ever touched it and watch for phishing — GMO explicitly warned that attackers may exploit the incident in social-engineering attempts, and the company says it will never ask for passwords or card details by email or phone.

2. PingCAP discloses a month-long breach of TiDB Cloud systems

PingCAP, the company behind the TiDB distributed database, disclosed on October 19 that an intruder accessed its internal systems between September 9 and October 7 using stolen service-account credentials, copying data and source code. Confirmed exposed: TiDB Cloud account records, SQL editor text, and billing information. A Japanese advisory published October 21 added that support tickets were exposed as well. PingCAP says no customer databases were accessed.

An extortion group calling itself FulcrumSec claims far more: 10.6 TB of stolen data, 180,000 tenant organizations, over 400,000 email addresses, 115,000 API keys (42,000 still active), and 413 private source-code repositories. Those claims are unverified — treat them as allegations, not facts.

Why it matters: the root cause — stolen service-account credentials, allegedly taken from the company’s own code — is the industry’s oldest open wound. GitGuardian counted about 29 million new hardcoded secrets on public GitHub in 2025, up 34% year over year. A database vendor getting bitten by the secrets problem is a reminder that credential hygiene at vendors is exactly what your threat model assumed they had handled.

3. Lazarus caught using post-quantum encryption in Operation FlashHole

Kaspersky researchers attributed a campaign dubbed Operation FlashHole to North Korea’s Lazarus Group. Active since at least July 2025, it targeted South Korean organizations in software, construction, and wired-communications equipment manufacturing. At least three companies are confirmed affected; Kaspersky suspects more.

The infection chain is a showcase of modern tradecraft: phishing pages lead to crafted GitHub Pages, which load external JavaScript and trigger an in-memory chain that abuses INISAFE CrossWeb EX, a legitimate Korean security tool, to run the Windows binary fsquirt.exe and install the TechHub downloader from private GitHub repos. The notable innovation is cryptographic: the LPEClient malware uses ML-KEM-1024, the standardized post-quantum key-exchange mechanism, to establish shared keys with its command-and-control servers before decrypting the final payload, the Cubridge backdoor. New tools TouchHub and ClientHub round out the set, and researchers found signs that AI generated profile photos for the fake applicant websites used as lures.

Why it matters: a nation-state adopting quantum-resistant encryption for its own malware is a warning sign. The likely motive is harvest-now-decrypt-later in reverse — protecting stolen data and C2 traffic against future decryption, including by other intelligence services. Expect ML-KEM in more malware within the next year.

4. OpenAI’s frontier models come to Google Cloud and Antigravity

OpenAI and Google announced a deal on October 21: OpenAI’s frontier models — reportedly the full GPT-6.1 lineup (Astra, Sol, Luna) — and Codex agentic workflows are coming to Google Cloud’s Model Garden and Marketplace, with general availability in the coming weeks. Enterprise customers will be able to buy OpenAI inference and draw down their existing GCP spending commitments to pay for it. The models are also coming to Antigravity, Google’s agent-driven coding tool, and the Gemini Agent.

The context: this follows OpenAI’s move onto AWS earlier this year, after Microsoft’s exclusive license on OpenAI’s intellectual property ended roughly six months ago. Google now sells all three leading closed-source model families — Gemini, Claude, and OpenAI’s — side by side, alongside open models.

Why it matters: the cloud model wars are shifting from who has the best model to who has the least procurement friction. Enterprises don’t want to move their data; they want the models where their data already lives. Google selling a competitor’s models next to Gemini reads as confidence that Gemini can win on quality once the plumbing stops deciding the deal.

5. Interpol’s Operation Serengeti III: 1,462 arrests, $105M recovered

Interpol announced the results of Operation Serengeti III on October 22: a coordinated campaign across 21 countries that ran from June 29 to August 31, targeting ransomware, business email compromise, and online scams. The numbers: 1,462 suspects arrested, 10,909 malicious networks dismantled, 65,929 victims identified, and more than $105 million in illicit funds recovered, against estimated losses above $385 million. Private-sector partners included Team Cymru, Kaspersky, Group-IB, and Fortinet.

Country-level highlights: Uganda arrested 365 people linked to investment and pension fraud rings; Angola seized more than 2,000 crypto-mining devices and arrested nine suspects; Nigeria arrested a suspect whose phishing operation had collected approximately 2.1 million email addresses.

Why it matters: Interpol reports AI is now linked to more than 55% of reported cybercrime in Africa — criminals are scaling scams faster than ever. Serengeti III shows the counter-strategy is working too: infrastructure intelligence, shared across borders, turning takedowns from single arrests into whole-network dismantlements.

The scoreboard

Key takeaways

• If you ran a server on Onamae Desktop Cloud: rotate every password, API key, and token that lived on that server, and treat any email about the incident as a potential phish.
• Vendor credential hygiene is your risk too: PingCAP’s breach started with stolen service-account credentials — ask your vendors how they manage secrets, and don’t hardcode your own.
• Post-quantum crypto is going criminal: Lazarus using ML-KEM-1024 means adversaries are already protecting their data against future decryption.
• The model marketplace is consolidating: with OpenAI on all three major US clouds, model choice is becoming a procurement decision, not a migration project.
• Coordinated takedowns are scaling up: Serengeti III’s 10,909 dismantled networks show cross-border infrastructure intelligence is the playbook that works.

References

• BleepingComputer: Japan’s Onamae Desktop Cloud hacked, up to 27,000 servers affected
• SC Media: Onamae Desktop Cloud suffers security breach affecting thousands of servers
• RuntimeWire: PingCAP confirms TiDB Cloud data exposure after stolen credentials accessed internal systems
• Dev.to: PHP2Shell, a breach and a key called 4: are you exposed?
• BleepingComputer: Lazarus hackers use post-quantum cryptography for malware delivery
• Digwatch: Lazarus group uses AI and post-quantum cryptography in its cyberattacks
• 9to5Google: OpenAI models are coming to Google Antigravity and Cloud
• TechFeatured: OpenAI’s models are coming to Google Cloud
• Cyber News: Operation Serengeti III disrupts nearly 11,000 cybercrime networks in Africa
• SecurityBoulevard: Interpol-led effort shuts down almost 11,000 cybercrime networks in Africa