The Record reported on 19 October that hackers stole data from customers of FirstVDS, a Russian hosting provider. FirstVDS said it found the attack on Saturday. It said the attackers used a flaw in VMmanager 6, ISPsystem software that hosts use to manage virtual machines across several physical servers. Malware then copied passwords, cloud credentials, configuration files and cryptocurrency wallets to a server the attackers controlled. It mounted the customers' disks in read-only mode, so it could copy files without changing them.
FirstVDS said only part of its infrastructure was hit, but did not say how many customers or servers. It has not said how the flaw was first used, which versions are affected, or whether the stolen data has been used. The hackers' identity and motives are unknown. FirstVDS said ISPsystem has released several patches, but the flaw is not fully fixed. It told notified customers to assume their data was stolen.
FirstVDS said the affected servers show no traces of the attack and still run normally. In this case, tools inside a customer's server would have seen nothing. This is our reading: the management layer sits beneath the customer's machine, outside the renter's view. Buyers can ask hosts whether that interface is exposed, how fast it is patched, and how secrets are kept off disks.