Hackers copy customer data from Russian host FirstVDS via VMmanager flaw

Hackers stole customer data from FirstVDS, one of Russia's oldest hosting providers, by exploiting a vulnerability in the VMmanager 6 virtualization management platform, The Record reported on October 19. According to the company, the attackers silently copied data from customers' virtual machine disks, including passwords, cloud credentials and cryptocurrency wallets. FirstVDS says the underlying flaw has not yet been fully fixed, which makes the incident relevant to other providers that use the same software.

What happened

According to The Record, FirstVDS discovered the breach on Saturday and disclosed it over the weekend. The attackers exploited a vulnerability in VMmanager 6, a platform developed by Russian software company ISPsystem that hosting providers use to manage virtual machines.

Only part of FirstVDS's infrastructure was affected, the company said. It did not disclose how many customers or servers were compromised, and The Record noted that no group has claimed responsibility. The identity and motives of the attackers remain unknown.

Technical details

FirstVDS said the attackers deployed malware that mounted customers' disks in read-only mode and copied data without modifying files or disrupting operations. The data was sent to a server controlled by the attackers. The company said the attack left "no traces" on the affected virtual servers, which continue to run normally.

According to FirstVDS, the stolen data included passwords, cloud service credentials, configuration files, cryptocurrency wallets and other files. The company has not said how the attackers initially exploited the vulnerability or which VMmanager versions were affected, and it is not known whether the stolen data has been used in follow-on attacks.

Response and remediation

FirstVDS said it disabled external access to the vulnerable management system and blocked communication with the attackers' server. As of Monday, it was still operating with restrictions, including limited VMmanager functionality.

ISPsystem has released several patches, including one deployed overnight on Monday, The Record reported. However, according to FirstVDS, the vulnerability is not yet fully fixed, and the vendor advises against restoring access to the management interface until further security updates are available.

What to do

FirstVDS told customers who received breach notifications to assume their data was stolen and to change passwords and access credentials. In practice, that means rotating credentials stored on affected servers, including cloud API keys and secrets in configuration files, and moving funds from any wallets kept on those systems.

Other hosting providers running VMmanager 6 should follow ISPsystem's guidance, apply all available patches and keep the management interface off the public internet until the vendor confirms a complete fix. FirstVDS, which has operated since 2002, also runs servers in the Netherlands and Kazakhstan, according to The Record.