ONUS

The organization is known by the alias ONUS.
Its headquarters is situated in Vietnam.
ONUS is described as a Vietnamese cryptocurrency trading platform.

The cyberattack against ONUS occurred on December 9, 2021.
The attackers exploited the Log4Shell vulnerability to gain entry.
The vulnerable component was the payment system's Cyclos server.
Initial access was obtained through a misconfigured sandbox environment.

The attackers then leveraged improper permissions on an Amazon S3 bucket.
This allowed them to exfiltrate sensitive databases from the platform.
The compromised databases contained nearly two million customer records.
Among the exposed data were personal identification details of users.
Know‑your‑customer (KYC) documentation was also part of the stolen information.

Transaction histories of the affected customers were included in the breach.
Encrypted credentials stored in the databases were likewise taken.
The threat actors released samples of customer ID documents and biometric verification material.
The attackers demanded a five‑million‑dollar ransom, which ONUS refused.
After the refusal, the stolen data was posted for sale on underground markets.

Investigators determined that the breach resulted from unpatched Log4j software.
Inadequate access controls on the cloud storage environment also contributed to the incident.
Despite subsequent remediation efforts, the attackers maintained persistent access to the system.
The exploitation took place shortly after the Log4Shell vulnerability was made public.