Ransomware Attack on SoftBank's IDCF Cloud Encrypts 3.6PB in 7 Minutes as Operations Team Misses Alerts for 7 Hours
On 7 October at approximately 03:40 JST, IDCF Cloud East Japan Region 1 operated by SoftBank subsidiary IDC Frontier experienced a sudden large-scale outage. Customers reported that virtual machines would not boot and console passwords had been reset, yet the operations team continued rebooting servers that were already encrypted.
Attack Timeline
According to reports compiled from Japanese ITmedia NEWS and security sources, the attackers claimed to have completed encryption of the entire region in only seven minutes. The encrypted assets included 239 virtualization hosts, 225 datastores, and at least 16,600 virtual-machine disks, totaling 3.6 PB of primary storage. In addition, 554,153 snapshots were destroyed, resulting in a backup capacity loss of 41.5 PB.
The ransom notes, named RECOVER-INFO.txt, were placed in the root directories of all 225 datastores at around 03:00. Operations personnel did not locate any of these files during the subsequent seven hours. Instead, they repeatedly attempted to restart non-functional virtual machines through VMware vCenter and changed management passwords multiple times.
Customers detected the problem earlier. By 08:34 JST the 75th support ticket had already described virtual machines failing to start. Frustrated by the lack of response, the attackers then defaced the cloud management console homepage with the message “IDCF CLOUD INFRASTRUCTURE SEIZED” and the subtitle “YOUR CLOUD IS OURS”. They also provided explicit instructions for locating the ransom notes via SSH or DCUI on any JE0-cluster ESXi host.
Technical Analysis
The seven-minute encryption window indicates that the attackers had already achieved persistent access, lateral movement, and control over the hypervisors well before the encryption phase. The simultaneous destruction of snapshots and backups removed any remaining leverage for victims. IDCF Cloud later confirmed that data stored in the affected region could not be recovered and advised customers to rebuild from their own independent backups.
The prolonged failure to notice the attack revealed systemic deficiencies: incomplete asset inventories, absent monitoring of critical datastore root directories, and ineffective escalation procedures. No zero-day exploit was required; the incident was a textbook case of incident-response breakdown.
Impact and Recommendations
The outage directly affected 495 customers across the tesla, henry, pascal, and joule availability zones, including enterprises and local government agencies. The provider chose not to pay the ransom and instead issued regular public updates.
Security experts recommend implementing the following immediate measures:
- Move critical backups to offline, immutable, or WORM storage that cannot be reached from production hypervisors.
- Harden VMware vCenter and ESXi hosts by restricting external exposure, enforcing strong authentication, and applying source-based access controls to SSH and DCUI.
- Configure high-priority alerts for anomalous file creation in datastore roots, mass virtual-machine power-offs, and unexpected encryption activity, delivered directly to on-call devices.
- Conduct unannounced ransomware tabletop exercises to ensure teams can recognize and respond to encryption events within minutes rather than hours.
The IDCF Cloud incident demonstrates that cloud-platform security ultimately depends on rapid detection and preservation of offline backups once an attacker has gained a foothold.
Related articles
From Pharmacies to the Cloud: Ransomware and Wiper Attacks Disrupt Russian Businesses Throughout 2025-2026
Positive Technologies analysis of ransomware and wiper incidents shows that 98% of successful attacks disrupted core business operations, with a median downtime of seven days for internal and external services. Financially motivated groups and hacktivists each accounted for 44% of ransomware incidents, while hacktivists dominated wiper attacks at 88%. Small and medium businesses were targeted in 48% of financially motivated cases and 41% of hacktivist operations. Attackers most often gained initial access through social engineering (53%), followed by credential compromise (28%) and vulnerability exploitation (25%). Notable incidents include the destruction of virtualization servers at a commercial cloud provider and the shutdown of over 2,100 stores in the VinLab retail chain. Specific tools observed include LockBit 3.0, Pay2Key, and the consumerWiper malware delivered via MSI packages.
Ransomware Group Emperador Claims 3.9 GB Data Theft from AB InBev
The ransomware group Emperador has added AB InBev, the manufacturer of Budweiser and Corona beers, to its list of alleged victims. The group claims to possess 3.9 GB of internal data and is demanding a $1 million Bitcoin ransom. The listing includes 329,244 social listening alerts, 2,510 corporate emails from subsidiaries, around 19,000 access records, internal service portal logs, and public key infrastructure certificates. Most of the data volume, 3.2 GB, is attributed to Azure storage assets. AB InBev has neither confirmed nor denied the claims, and no samples have been published to verify authenticity. The announcement provides no details on how the data was allegedly obtained, such as an exposed storage account or leaked credentials. While access records and certificates could aid network mapping and lateral movement, the lack of private keys or confirmed encryption of systems limits the immediate impact assessment.
Russian Ransomware Groups INC and The Gentlemen Deploy AI-Driven Phantom Framework for Fully Automated Attacks
SOCRadar researchers have disclosed the Phantom framework, an AI-powered autonomous ransomware attack platform operated by members linked to the INC and The Gentlemen groups. The system uses commercial large language models routed through OpenRouter to scan 7,158 edge devices, steal 535 administrator accounts, and compromise 4,140 endpoints. AI agents autonomously generate custom encryption binaries, craft personalized ransom demands based on stolen financial data, and write kernel drivers to disable EDR solutions before encryption. The framework runs on 32 custom MCP servers that give the AI direct access to scanning, credential abuse, financial analysis, and anti-detection tooling. Human operators only supply target prompts and approve final actions while the AI executes the entire kill chain. Phantom Agent v3.1 implants masquerade as Windows Update components and communicate over encrypted channels with randomized polling intervals. The discovery reveals a mature Ransomware-as-a-Service model that lowers the barrier for other criminal groups to conduct large-scale AI-automated extortion.
Creator of Ransomware Forum Ramp4u Hands Over 1.5 Billion Rubles to Russian Law Enforcement
A darknet researcher known as exkgb has published an analysis of the ransomware forum Ramp4u.io, revealing that its founder cooperated with authorities by transferring 1.5 billion rubles. The report follows the author's earlier coverage of the Exploit forum administration, which drew significant reader interest with only a 6% bounce rate. Ramp4u is described as a dedicated ransomware marketplace operating on the dark web. The article positions the forum as a key platform in the ransomware ecosystem and notes the unusual cooperation with security forces. exkgb continues to monitor and document major darknet platforms for the cybersecurity community.