On the night of November 1, an attacker gained access to the management systems of Russian cloud services provider Beget and deployed malware that erased server data, forcing the company to rebuild its cloud infrastructure from scratch, Beget said. More than a week later, Beget said 60% of shared hosting and 40% of dedicated servers had been restored, while its current assessment was that VPS file backups would be available for only half of VPS users.
Beget, a major Russian web-hosting, cloud and domain-registration provider serving more than 200,000 customers including online stores, media and educational services, detected the attack shortly after the malware activated and disconnected all servers from the network to stop the malicious activity from spreading.
In a November 3 announcement, Beget said the attacker gained access to the management layer of its entire architecture and executed data-zeroing scripts. Beget said all data in its cloud infrastructure, including VPS, S3 and Kubernetes, was lost, along with CDN settings and IP configurations. The company said VPS binary backups were completely lost, while VPS file backups partially survived.
"Unfortunately, it is impossible to recover all data," Beget said about VPS data, adding that it "spent a long time looking for solutions, but according to our current assessment, VPS file backups will be available for only half of users." Even when a backup exists, the company said matching it to specific users is "technically complex."
The scale of the recovery effort is massive, with roughly 1,000 servers requiring manual checks for vulnerabilities and hidden scripts before they can be brought back online, the firm said. Beget is taking a cautious approach, treating all parts of its infrastructure as potentially infected. "We are therefore cleaning out everything we can and reworking every potentially vulnerable point, including those that previously did not appear to pose a risk."
Beget said its investigation found no evidence that the attacker tried to download or modify any data on the compromised servers, and that the attack appears to have been focused solely on destruction. The company has notified police and government agencies and is working with cybersecurity firms to remediate the incident and recover as soon as possible.
Analysis
Why This Matters
- The attack demonstrates the devastating potential of data-wiper malware aimed at cloud infrastructure, disrupting services for hundreds of thousands of customers.
- The destruction of VPS backups highlights risks of relying on provider-managed backups without independent copies.
- Recovery progress will be watched as a test of resilience for a major Russian hosting provider, with implications for broader internet infrastructure in the region.
Background
Beget is one of Russia's largest web-hosting and cloud service providers, serving over 200,000 customers including online stores, media outlets and educational services. The company manages roughly 1,000 servers and provides domain registration, shared hosting, VPS, and cloud services. The November 1 attack is described as destructive, with attackers gaining access to the management layer before deploying data-zeroing scripts.
What to Watch
- Whether Beget can restore the remaining dedicated servers and shared hosting, and how long full recovery takes.
- If any additional data recovery options emerge for the half of VPS users without backup access.
- Whether law enforcement identifies the attackers and whether similar attacks target other Russian hosting providers.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedBeget is rebuilding its cloud infrastructure from scratch after a data-wiping attack.BleepingComputer: “A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said.”
- SupportedThe attacker gained access on the night of November 1.BleepingComputer: “On the night of November 1st, the attacker gained access to the management systems”
- SupportedBeget said data in VPS, S3 and Kubernetes was lost.BleepingComputer: “Beget said all data in its cloud infrastructure, including VPS, S3, and Kubernetes, was lost”
- SupportedMore than a week after the attack, 60% of shared hosting and 40% of dedicated servers had been restored.BleepingComputer: “More than a week after the destructive attack, Beget says that 60% of shared hosting and 40% of the dedicated servers it manages have been restored”
- SupportedBeget's VPS binary backups were completely lost, while its VPS file backups partially survived.BleepingComputer: “The company also said that VPS binary backups were completely lost, and VPS file backups have partially survived.”
- SupportedBeget said, “Unfortunately, it is impossible to recover all data,” about VPS data.BleepingComputer: ““Unfortunately, it is impossible to recover all data,” Beget said about VPS data”
- SupportedBeget said it had spent a long time looking for solutions and assessed that VPS file backups would be available for only half of users.BleepingComputer: “it "spent a long time looking for solutions, but according to our current assessment, VPS file backups will be available for only half of users."”
- SupportedBeget described matching an existing backup to specific users as “technically complex.”BleepingComputer: “Even when a backup exists, the company said it would take time to match it to specific users, a task it describes as “technically complex.””
- SupportedRoughly 1,000 servers require manual checks for vulnerabilities and hidden scripts before they can be brought back online.BleepingComputer: “roughly 1,000 servers requiring manual checks for vulnerabilities and hidden scripts before they can be brought back online”
- SupportedBeget said, “We are therefore cleaning out everything we can and reworking every potentially vulnerable point, including those that previously did not appear to pose a risk.”BleepingComputer: ““We are therefore cleaning out everything we can and reworking every potentially vulnerable point, including those that previously did not appear to pose a risk.””
- SupportedBeget said its investigation found no evidence the attacker tried to download or modify data, and that the attack appeared focused solely on destruction.BleepingComputer: “Beget said its investigation did not find any evidence that the attacker tried to download or modify any data on the compromised servers, and that the attack appears to have been focused solely on destruction.”
- SupportedBeget said it had notified police and government agencies and was working with cybersecurity firms on remediation and recovery.BleepingComputer: “The company has notified the police and government agencies and is also working with cybersecurity firms to remediate the incident and recover as soon as possible.”
