Beget says attackers destroyed its cloud and half of VPS backups

Beget, a Russian web host and domain registrar, says the cyberattack that took it offline on November 2 destroyed its cloud platform, and that it cannot recover the data of every virtual server customer. In its update on Friday, the company said file backups of VPS servers exist for only about half of their users, and that its cloud infrastructure is being built again from scratch.

According to the timeline on its website, the attackers reached Beget's management servers at about 02:00 Moscow time on November 2 (23:00 UTC on November 1) and started malware that deletes data from servers half an hour later. Beget says it noticed the intrusion at 02:40 and cut every server off the network at 02:55. Its first detailed account describes access to "the management layer of the whole architecture" followed by scripts that wiped data.

What was lost

In the cloud, all data on VPS, S3 storage and Kubernetes was lost, along with CDN and IP settings, Beget said on November 3. Binary backups of VPS servers were lost completely; only file-level backups survived. Shared hosting fared better: Beget expected almost all of those websites to be recoverable, and file backups of shared hosting and the cloud were kept. More than 1,000 servers had to be checked by hand before they could be switched back on, because each one could hold hidden malicious scripts.

On November 6 the estimate for VPS customers got worse. After searching for other ways to restore the data, Beget said the surviving file backups cover only about half of VPS users, and that matching each backup to the right account is slow because part of the account data in its internal systems was also lost.

Recovery so far

Dedicated servers that customers run themselves were back on the day of the attack, along with Beget's name servers. By November 5, 60% of shared hosting servers, 40% of the dedicated servers Beget manages and 99% of mail servers were running. The remaining hosting servers were damaged more heavily and are being restored from backups. A control panel with limited features reopened on November 7, and Beget said that day it would start restoring sites from backups that night and expected to offer new VPS servers within about 48 hours.

Beget says it has seen no attempts to download or change data on servers that held customer data, but recommends that customers change every password, access key and other credential that was stored on its servers. It says it is still treating the threat as active, and is working with the police, security companies and NKTsKI, Russia's national computer incident coordination centre.

What is not known

Beget has not said how the attackers got into its management systems, and says it is holding back details to protect the investigation. No group has publicly claimed the attack, and Beget has not said how many customers lost data for good.