Beget rebuilds cloud after data-wiping attack

Beget said an attacker used data-wiping malware on the night of November 1 and that the Russian cloud provider is rebuilding its infrastructure from scratch. The company detected the attack shortly after the malware executed and took all servers offline to stop the infection from spreading.

Beget, which offers web hosting, cloud services and domain registration to more than 200,000 customers, said the intruder reached the management layer of the full architecture and ran scripts that erased data. All cloud data was lost, including VPS, S3 and Kubernetes, along with CDN settings and IP configurations.

More than a week after the destructive attack, Beget said 60% of shared hosting and 40% of dedicated servers had been restored, with work still under way. VPS binary backups were completely lost, while file backups partly survived. A November 6 assessment said those file backups would be available for about half of VPS users. Beget said matching surviving backups to individual users will take time and described the job as "technically complex." The company said "Unfortunately, it is impossible to recover all data" about VPS data.

Recovery work involves about 1,000 servers that must be manually checked for vulnerabilities and hidden scripts before they return to service, Beget said. The company treats every part of its infrastructure as potentially compromised and is rebuilding "every potentially vulnerable point, including those that previously did not appear to pose a risk."

Beget's investigation found no evidence that the attacker tried to download or change data on the affected servers, and the incident appears to have been purely destructive. The provider has notified police and government agencies and is working with cybersecurity firms to address the damage.