Beget, one of Russia’s largest domain registrars and hosting providers, lost every binary backup of its virtual servers when attackers wiped data across its cloud overnight on Sunday. The company said Wednesday that it had begun bringing some servers back, but staff must inspect more than 1,000 servers by hand, so a full recovery will take time.
Beget says the attackers reached the systems it uses to manage its infrastructure and ran scripts built to erase data. The cloud side took the worst of it. Data tied to virtual private servers, cloud storage and Kubernetes services disappeared. File level backups survived, though, and Beget says they could help recover some of the information.
Shared hosting looks better off. Beget says nearly all sites on that infrastructure can likely return, but each server needs its own check first. By Wednesday, some sites were back, engineers were removing malicious files and checking data integrity, and customer managed dedicated servers were running again.
The attack disrupted hundreds of websites. Local media reported problems at businesses, government agencies and research institutions, including the Naryan-Mar city administration website and the Chestny Znak product labeling system. Kommersant reports that small and medium sized businesses running online stores and company sites took the brunt.
Beget started in 2007 and ranked second among .RU registrars in October, with about 540,700 domains and a 14.7% share, according to Kommersant.
Beget says it found no sign that attackers tried to download or change data on servers holding customer information. Even so, it urged customers to change passwords, access keys and other credentials that may have sat on affected systems. It has not said how the attackers got in, citing security concerns and an ongoing investigation, and no group has claimed the attack. It also told customers the attack could count as force majeure under Russian law.
The attack comes as Russian digital infrastructure firms face more cyberattacks and drone strikes. In October, hackers exploited a flaw in software used by hosting provider FirstVDS to steal customer passwords, cloud credentials and cryptocurrency wallets. Earlier this year, the European Union sanctioned Beget and a co-owner, accusing the company of providing services to Russian backed authorities in occupied Crimea, Donetsk and Luhansk and to defense related entities.
