In brief
- Russian hosting firm FirstVDS says attackers used a flaw in VMmanager 6 to copy passwords, cloud credentials, configuration files and cryptocurrency wallets from some customer servers.
- The malware mounted disks read-only, so the company says there are no traces on the affected machines and services kept running.
- How many customers were hit is not disclosed, the attacker is unknown, and FirstVDS says the flaw is not fully fixed.
FirstVDS, one of Russia’s oldest hosting providers, says hackers exploited a flaw in its virtualisation management software and copied sensitive customer files. Anyone who runs a site or app on a FirstVDS virtual server, including in the Netherlands or Kazakhstan, may need to treat stored credentials as compromised.
The company has not said how many customers were affected.
What does FirstVDS say happened?
The attack was discovered on Saturday and hit part of the firm’s infrastructure, The Record reported on 19 October, citing FirstVDS.
The attackers exploited a vulnerability in VMmanager 6, a virtualisation management platform from Russian software company ISPsystem. Hosting providers use it to manage virtual machines across physical servers.
Malware then copied data from customers’ virtual servers, including “passwords, cloud service credentials, configuration files, cryptocurrency wallets and other files,” The Record reported. The files went to a server controlled by the attackers.
How did they copy the data without crashing the servers?
FirstVDS says the attackers did not break into the virtual machines themselves. The malware mounted their disks in read-only mode, so it could copy files without changing them or stopping normal operations.
“As a result, there are no traces of the attack on the affected virtual servers, which continue to operate normally,” the company said, according to The Record.
That makes forensics harder for customers. The machines look fine, but the files may already be gone.
Who is affected, and what should they do?
FirstVDS has operated since 2002. It rents virtual private servers for websites, applications and databases, and also offers servers in the Netherlands and Kazakhstan, The Record reported.
The company has not disclosed how many customers or servers were compromised. It warned customers who received breach notices to assume that data on their servers had been stolen, and to change passwords and access credentials.
| What FirstVDS says | Detail |
|---|---|
| Discovery | Saturday |
| Software hit | VMmanager 6 (ISPsystem) |
| Data copied | Passwords, cloud credentials, configs, crypto wallets |
| Access method | Disks mounted read-only |
| Traces on VMs | None, company says |
| Customer count | Not disclosed |
Is the hole closed?
Not fully. FirstVDS says it disabled external access to the vulnerable management system and blocked communications with the attackers’ server.
ISPsystem has released several patches, including one overnight on Monday, but “the vulnerability has not yet been fully fixed,” according to FirstVDS. The vendor has advised against restoring access to the management interface until more updates are available.
As of Monday, FirstVDS was still running with some restrictions, including limited VMmanager functions, The Record reported from its status page.
What is still unknown?
FirstVDS has not said how the attackers first exploited the flaw, which software versions were affected, or whether the stolen data has been used in further attacks. The identity and motives of the hackers remain unknown.
Our read
This is TSN’s analysis. A read-only disk mount that leaves no traces on the guest is a reminder that management planes can be a quieter path into cloud data than hacking each customer machine. Until FirstVDS names a scale and ISPsystem finishes the fix, other VMmanager 6 hosts will be watching their own panels as carefully as their customers watch passwords.
How we sourced this
- The account is The Record’s reporting of FirstVDS’s statements. We did not fetch a FirstVDS original notice.
- Customer numbers, attacker identity and whether the data has been abused are not disclosed. We do not speculate on who was behind it.
Sources
Related stories
- Compromised ConnectWise Cloud Backup Credential Used to Access M365 Tenants
- Hollys Coffee Says Hackers Leaked Members’ IDs, Passwords and Addresses
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
