Russian cloud and hosting provider Beget is rebuilding its cloud infrastructure from scratch after a data-wiping attack erased server data across its platform, the company has said. The attack struck overnight on 1 November, and more than a week later recovery was still under way, with some customer data lost for good.

Beget is a major provider of web hosting, cloud services and domain registration, serving more than 200,000 customers, including online shops, media outlets and educational services. The scale of the incident, and the fact that backups were destroyed along with live data, makes it one of the most destructive hosting attacks reported this year.

Attackers reached the management layer

According to Beget, the attacker gained access to the management systems of the company's entire architecture and then deployed malware that erased data from its servers. The company detected the intrusion shortly after the malware activated and disconnected all of its servers from the network to stop the attack spreading further.

Beget said the attack destroyed data across its virtual private servers, S3 storage and Kubernetes environments, along with content delivery network settings and IP configurations. In an update on 3 November, the company said the attacker had reached the control plane of its whole architecture and run scripts that zeroed data.

The damage to backups was severe. Beget said all binary backups of its virtual private servers were completely lost, and that file backups had survived for only about half of its VPS users. The company told customers that it was, in its own words, impossible to recover all of the data, adding that it had spent a long time looking for solutions before reaching that assessment.

Recovery is slow and manual

By 5 November, Beget reported that 60 per cent of its shared hosting servers and 40 per cent of the dedicated servers it manages had been restored. Dedicated servers run directly by customers, along with DNS name servers, had returned online earlier in the recovery.

The company is treating every part of its environment as potentially compromised. Around 1,000 servers require manual inspection for vulnerabilities and hidden malicious scripts before they can be brought back into service. Beget said it was cleaning out everything it could and reworking every potentially vulnerable point, including points that had not previously appeared to pose a risk.

Even where a file backup has survived, restoring it is not straightforward. Beget said matching a backup to the right customer is technically complex, and that the work would take time.

No evidence of data theft

Beget said its investigation found no evidence that the attacker tried to download or modify any data on the compromised servers, and that the attack appears to have been focused solely on destruction rather than theft or extortion. The company has not named an attacker, and has not said how the intruder first gained access.

The provider has notified the police and government agencies, and is working with cybersecurity firms on the response and recovery. It has not given a date for full restoration of its cloud services.

The incident is a stark reminder that a compromise of a provider's management layer can destroy live systems and backups at the same time. For customers, the lesson is that backups held inside the same infrastructure as the systems they protect may not survive an attack aimed at the provider itself.

Sources: SC Media and CyberBreachNet.