Hackers gained access to the infrastructure of Russian hosting provider FirstVDS by exploiting a critical vulnerability in the VMmanager 6 virtualization platform. The attackers managed to steal customers' passwords, access keys, and crypto wallets, and the hosting control panel still remains blocked due to the developers' inability to promptly fix the problem.
Hackers gained access to the infrastructure of Russian hosting provider FirstVDS by exploiting a critical vulnerability in the VMmanager 6 virtualization platform. The attackers managed to steal customers' passwords, access keys, and crypto wallets, and the hosting control panel still remains blocked due to the developers' inability to promptly fix the problem.
As stated in the official announcements of FirstVDS, the infrastructure breach occurred on October 17. The attack affected some of the virtualization nodes on which the attackers deployed malicious software. This program mounted the disks of the client virtual servers in read-only mode, which allowed the hackers to silently copy information without changing the files on the servers themselves.
The leak exposed passwords, SSH and API keys, cloud service tokens, configuration files, command history, and user crypto wallets. All collected data was automatically sent to the attackers' third-party server.
As of October 20, the company acknowledged that there is still no complete solution to close the vulnerability. Despite the release of several interim patches, the software developer has banned access to the system.
"Access to the virtualization panel for customers will remain closed for the time being, and most likely for a long time. We are transferring the main server management functions to the personal account. We do not rule out that we will leave it like this in the future: all management will be in the personal account," explained FirstVDS representatives.
The provider has now urged affected customers to urgently withdraw funds to new crypto wallets created on clean devices, completely update all keys and passwords, and revoke old tokens in cloud consoles and payment systems. The hosting company has warned those customers who stored personal data about the legal requirement to report to Roskomnadzor.
The VMmanager platform is a Russian development for IT infrastructure management, created by ISPsystem, a company part of the Astra Group. The protracted resolution of the problem and the forced restructuring of the server management architecture clearly highlight the current state of security and reliability of Russian infrastructure software.
