EN PT-BR
← Voltar ao feed
critical cloud_hosting

Russian cloud provider Beget rebuilds infrastructure from scratch after destructive wiper attack

1 fonte(s) · 1 atualização(ões) · publicado 09/11/2026 14:50 · coletado há 1 hora

Beget, a major Russian web-hosting, cloud and domain-registration provider with more than 200,000 customers, was hit by a destructive attack that wiped data across its cloud infrastructure. The attacker reached the management layer of the company's entire architecture and ran data-zeroing scripts, which destroyed VPS, S3 and Kubernetes data along with CDN settings and IP configurations (bleepingcomputer.com; beget.com). Beget disconnected all servers once the malware was detected, and it says the attack appears to have been focused solely on destruction, with no evidence of data download or modification (bleepingcomputer.com). No attacker has been named, and neither the article nor the vendor timeline names a vulnerability or CVE, so the initial access method remains undisclosed. Recovery is still in progress, and the company is rebuilding its cloud infrastructure from scratch.

Detalhes técnicos

  • The vendor timeline places the start of the intrusion at 02:00 MSK on 2 November 2026, when the attackers reached the management servers. The malware was launched at 02:30 MSK, the breach was detected at 02:40 MSK, and all servers were disconnected at 02:55 MSK (beget.com/en/hosting/virtual).
  • VPS binary backups were completely lost, while VPS file backups survived only in part. Beget estimates that file backups will be available for roughly half of its VPS users, and matching each backup to its owner is described as technically complex (bleepingcomputer.com; beget.com/en/hosting/virtual).
  • The impact is classed as data destruction (T1485) on the provider's cloud and hosting services. The public statements describe no data exfiltration.

Remediação

  • Beget states that it is cleaning out everything it can and reworking every potentially vulnerable point, including components that previously looked low-risk. Roughly 1,000 servers require manual checks for vulnerabilities and hidden scripts before they return to service (bleepingcomputer.com).
  • Recovery progress: about 60% of shared hosting servers and 40% of managed dedicated servers were restored by the reporting date (bleepingcomputer.com). The vendor timeline lists NS servers restored on 2 November and mail and webmail restored on 3 November (beget.com/en/hosting/virtual).
  • Beget has notified the police and government agencies and is working with cybersecurity firms on remediation (bleepingcomputer.com).

Relatos divergentes

  • The article says the attacker gained access on the night of 1 November. The vendor timeline (beget.com/en/hosting/virtual) dates the start of the intrusion to 02:00 MSK on 2 November, which is the vendor's version and is used here.

Linha do tempo

  1. bleepingcomputer.com ↗ · pub. 09/11/2026 14:50 · coletado 09/11 16:00 primeiro registro

    Russian cloud provider Beget rebuilds infrastructure from scratch after destructive wiper attack

    ler a análise desta fonte

    Beget, a major Russian web-hosting, cloud and domain-registration provider with more than 200,000 customers, was hit by a destructive attack that wiped data across its cloud infrastructure. The attacker reached the management layer of the company's entire architecture and ran data-zeroing scripts, which destroyed VPS, S3 and Kubernetes data along with CDN settings and IP configurations (bleepingcomputer.com; beget.com). Beget disconnected all servers once the malware was detected, and it says the attack appears to have been focused solely on destruction, with no evidence of data download or modification (bleepingcomputer.com). No attacker has been named, and neither the article nor the vendor timeline names a vulnerability or CVE, so the initial access method remains undisclosed. Recovery is still in progress, and the company is rebuilding its cloud infrastructure from scratch.

    Technical Details

    • The vendor timeline places the start of the intrusion at 02:00 MSK on 2 November 2026, when the attackers reached the management servers. The malware was launched at 02:30 MSK, the breach was detected at 02:40 MSK, and all servers were disconnected at 02:55 MSK (beget.com/en/hosting/virtual).
    • VPS binary backups were completely lost, while VPS file backups survived only in part. Beget estimates that file backups will be available for roughly half of its VPS users, and matching each backup to its owner is described as technically complex (bleepingcomputer.com; beget.com/en/hosting/virtual).
    • The impact is classed as data destruction (T1485) on the provider's cloud and hosting services. The public statements describe no data exfiltration.

    Remediation

    • Beget states that it is cleaning out everything it can and reworking every potentially vulnerable point, including components that previously looked low-risk. Roughly 1,000 servers require manual checks for vulnerabilities and hidden scripts before they return to service (bleepingcomputer.com).
    • Recovery progress: about 60% of shared hosting servers and 40% of managed dedicated servers were restored by the reporting date (bleepingcomputer.com). The vendor timeline lists NS servers restored on 2 November and mail and webmail restored on 3 November (beget.com/en/hosting/virtual).
    • Beget has notified the police and government agencies and is working with cybersecurity firms on remediation (bleepingcomputer.com).

    Conflicting Reports

    • The article says the attacker gained access on the night of 1 November. The vendor timeline (beget.com/en/hosting/virtual) dates the start of the intrusion to 02:00 MSK on 2 November, which is the vendor's version and is used here.