Breaching Russian Hosting Providers via VMmanager 6 Vulnerability

Attackers carried out a large-scale cyberattack on Russian hosting providers, exploiting a vulnerability in the VMmanager 6 management system by Astra Group. The incident affected numerous servers and led to the leak of confidential client data.

Among the stolen data: passwords, SSH and API keys, tokens, configuration files, and crypto wallets.

The following providers were at risk:

• FirstVDS
• ForestsNet Cloud
• ITLDC
• YaColo
• SpaceCore
• PQ.Hosting
• 4VPS
• PSB Hosting
• UnihostKZ
• Illevante Cloud

Although the main confirmed reports come from Russian and Russian-speaking hosting providers, geographically the attack is not limited to Russia. Experts recommend checking emails from your providers and immediately changing or removing secrets from applications on servers to minimize damage.