Russian Hosting Provider FirstVDS Breached via VMmanager Vulnerability
Hackers stole customer passwords and credentials from Russian hosting provider FirstVDS by exploiting a vulnerability in the VMmanager 6 server management software.
Russian hosting provider FirstVDS has disclosed a significant data breach that resulted in the theft of customer passwords, access credentials, and other sensitive information. The attackers exploited a vulnerability in VMmanager 6, a virtualization management platform developed by ISPsystem, to gain unauthorized access to data stored on customers' virtual servers.
The breach, discovered on Saturday, affected a portion of FirstVDS's infrastructure. While the attackers did not directly compromise the virtual machines themselves, they deployed malware that mounted customer disks in read-only mode. This allowed them to copy sensitive files, including passwords, cloud service credentials, configuration files, cryptocurrency wallets, and other data, without disrupting the normal operations of the affected servers.
FirstVDS, a prominent Russian hosting provider operating since 2002, has not disclosed the exact number of customers or servers impacted by the incident. The company has urged customers who received breach notifications to change their passwords and access credentials immediately, assuming that any data stored on their servers may have been compromised. The stolen information was exfiltrated to a server controlled by the attackers.
The vulnerability exploited was within ISPsystem's VMmanager 6 platform, which is used by hosting providers to manage virtual machines. ISPsystem has released several patches since the breach, but FirstVDS indicated that the vulnerability has not yet been fully fixed. The software vendor has advised against restoring external access to the management interface until further security updates are deployed.
In response to the attack, FirstVDS has disabled external access to the vulnerable management system and blocked communications with the attackers' server. As of Monday, the company was still operating with some restrictions, including limited availability of VMmanager functions, according to its service status page.
Details regarding how the attackers initially exploited the vulnerability, the specific versions of VMmanager affected, and whether the stolen data has been used in subsequent attacks remain unknown. The identity and motives of the threat actors are also yet to be determined.
This incident highlights the ongoing risks associated with third-party software vulnerabilities in critical infrastructure. Hosting providers, managing vast amounts of customer data, are prime targets, and a compromise in management software can have far-reaching consequences for their clients.