[TokyoGirl]

Hello everyone,
Japan has recently seen a series of serious cyber incidents, including ransomware attacks, unauthorized access, and disruptions affecting IT service providers.
One case I find particularly interesting is the October 7 ransomware attack against IDC Frontier (IDCF), a SoftBank subsidiary operating cloud infrastructure in Japan.
According to the company's public reports, the attack affected cloud services used by 495 companies and local governments, leaving virtual servers unavailable and creating major recovery challenges.
The October 14 update also disclosed unauthorized queries involving customer registration information. However, the company reported no evidence of data exfiltration from affected customer virtual servers.
Another interesting point: so far, I have not observed a corresponding victim listing on the ransomware leak sites I monitor.
Traditionally, many ransomware groups have relied on double extortion — encrypting systems, stealing data, and threatening to publish it.
But could we be seeing a greater emphasis on disrupting or disabling critical IT infrastructure itself?
If attackers can compromise shared cloud infrastructure, the consequences can extend far beyond a single organization.
I am particularly interested in whether this reflects an evolution in criminal ransomware operations, a more destructive objective, or a combination of both.
This is a research question, not a conclusion about the attackers behind the IDCF incident.
Are researchers in other countries observing similar cases where major infrastructure disruption occurs without a visible leak-site listing?
I'd be very interested in hearing your thoughts and observations.
Greetings from Japan!

[kindpn]

Hey, Japanese researcher
To be honest, it’s hard to say anything definitive at this stage.
IDCF hasn’t made an official announcement, and the ransomware group hasn’t issued a statement either.
One thing is clear: if the attackers intended to make threats, they would typically do so sooner rather than later.
Since that hasn’t happened, there might be a different objective-perhaps something geopolitical.
We’ll have to keep an eye on how things unfold.
Bye.

[TokyoGirl]

Hi kindpn! 😎
Thank you for your thoughtful reply. Your suggestion about a possible geopolitical objective is particularly interesting.
First, I'd like to clarify one important point.
IDC Frontier (IDCF) has issued several official announcements about this incident.
Here is the timeline:

• October 7, first report: IDCF announced a service disruption caused by unauthorized access.
  
• October 7, second report: IDCF explicitly confirmed a ransomware attack affecting 495 companies and local governments.
  
• October 8, third report: IDCF reported that virtual servers in four affected zones could not be restarted, and recovering stored data would be difficult.
  
• October 9, fourth report: IDCF explained its emergency response arrangements.
  
• October 14, fifth report: IDCF reported unauthorized queries involving customer registration information, while stating that customer virtual-server data had not been exfiltrated.
  

However, IDCF has not publicly identified the ransomware family or the group responsible.
Now, I'd like to share something particularly interesting.
A message attributed to the attackers reportedly appeared on the IDCF cloud management console on October 7.
 
The message begins:
"YOUR CLOUD IS OURS."
It also claims:

• 239 hypervisors breached
  
• 225 out of 225 datastores encrypted
  
• More than 16,600 VM disks sealed
  
• 3.6 PB of primary storage
  
• 554,153 snapshots destroyed
  
• 41.5 PB of backup capacity gone
  

These numbers are the attackers' own claims, not independently verified findings.
One particularly striking passage reads:
"Seven minutes. Exactly seven minutes is what it took to turn your entire East Japan Region 1 into ciphertext."
Another passage states:
"We left 225 copies. We made it impossible to miss. You missed it anyway."
The message also claims that recovery information files were left on the datastore roots and criticizes the response of IDCF's operations team.
I find the tone and apparent technical knowledge of the message remarkable.
From the beginning, I have wondered whether the scale of destruction is unusually severe for an attack motivated primarily by financial gain.
If the attackers' claims about the snapshots and backup capacity are accurate, the operation would have severely undermined recovery capabilities across a shared cloud environment.
At the same time, the message refers to a private contact mechanism, suggesting that extortion may still have been part of the operation.
This brings me back to your interesting observation.
Could the attackers have been pursuing objectives beyond financial extortion, including deliberate infrastructure disruption?
And what made you consider a possible geopolitical motive?
I would genuinely appreciate hearing more about your reasoning.
I'd also like to invite everyone reading this thread to share their observations.
If you've encountered similar attacks, noticed relevant technical indicators, or have any thoughts about the scale and nature of this incident, please feel free to join the discussion.
Even a small observation can contribute to a better understanding of what happened.
Thank you again, and greetings from Japan! 😊