Overview
Russian web hosting and cloud provider Beget has had to rebuild its cloud infrastructure from scratch after a data-wiping attack, according to BleepingComputer. The company serves more than 200,000 customers, including online stores, media outlets, and educational services.
What Happened
- The attacker gained access on the night of November 1.
- They reached the management layer of Beget's infrastructure and ran data-zeroing scripts.
- Beget disconnected all servers from the network shortly after the destructive activity began.
- The company published a detailed update on November 3.
The malware family has not been named, and no attacker has been identified. Beget says its investigation found no sign that data was downloaded or modified, and that the attack appeared focused solely on destruction.
Impact
- All data in the cloud infrastructure was lost, including VPS, S3, and Kubernetes data, plus CDN settings and IP configurations.
- VPS binary backups were completely lost. VPS file backups partly survived and are expected to cover only about half of VPS users.
- About 1,000 servers need manual checks for vulnerabilities and hidden scripts before returning to service.
- More than a week after the attack, roughly 60% of shared hosting and 40% of dedicated servers had been restored.
Beget acknowledged that recovering all data is impossible for VPS customers and said it is "cleaning out everything we can and reworking every potentially vulnerable point."
Response
Beget has notified police and government agencies and is working with cybersecurity firms on remediation and recovery.
Lessons for Defenders
The source article offers no recommendations, but the incident illustrates familiar points:
- Protect the management plane. Access to orchestration and hypervisor tooling lets an attacker destroy everything at once.
- Isolate backups. Backups reachable from the same management layer can be wiped along with production data. Keep immutable or offline copies.
- Test full-rebuild recovery. Rebuilding an entire cloud takes weeks; know your recovery time before you need it.
- Segment and monitor privileged access to catch destructive scripts early.