Russian cloud firm Beget rebuilds from scratch after data wiper attack
A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said.
A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said.
On the night of November 1st, the attacker gained access to the management systems of the company's entire architecture and deployed malware that erased server data.
The Russian cloud provider detected the attack shortly after the malware activated and disconnected all servers from the network to stop the malicious activity from spreading across its infrastructure.
Beget is a major Russian web-hosting, cloud, and domain-registration provider that serves more than 200,000 customers, including online stores, media, and educational services.
More than a week after the destructive attack, Beget says that 60% of shared hosting and 40% of the dedicated servers it manages have been restored, and recovery is still in progress.
In a more detailed announcement on November 3, Beget says that the attacker gained access to the management layer of its entire architecture and then executed data-zeroing scripts.
The scale of the recovery effort is massive, with roughly 1,000 servers requiring manual checks for vulnerabilities and hidden scripts before they can be brought back online, said the firm.
The company also said that VPS binary backups were completely lost, and VPS file backups have partially survived, and hackers use n-day exploits in zero-click attacks on iOS, Android devices
Beget said its investigation did not find any evidence that the attacker tried to download or modify any data on the compromised servers, and that the attack appears to have been focused solely on destruction.
What happened
A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said.
On the night of November 1st, the attacker gained access to the management systems of the company's entire architecture and deployed malware that erased server data.
The Russian cloud provider detected the attack shortly after the malware activated and disconnected all servers from the network to stop the malicious activity from spreading across its infrastructure.
Who is affected
Beget is a major Russian web-hosting, cloud, and domain-registration provider that serves more than 200,000 customers, including online stores, media, and educational services.
More than a week after the destructive attack, Beget says that 60% of shared hosting and 40% of the dedicated servers it manages have been restored, and recovery is still in progress.
Why it matters
In a more detailed announcement on November 3, Beget says that the attacker gained access to the management layer of its entire architecture and then executed data-zeroing scripts.
The scale of the recovery effort is massive, with roughly 1,000 servers requiring manual checks for vulnerabilities and hidden scripts before they can be brought back online, said the firm.
Technical details
The company also said that VPS binary backups were completely lost, and VPS file backups have partially survived, and hackers use n-day exploits in zero-click attacks on iOS, Android devices
Response
Beget said its investigation did not find any evidence that the attacker tried to download or modify any data on the compromised servers, and that the attack appears to have been focused solely on destruction.