Ransomware attack on Belarusian cloud firm disrupts businesses for days

Belarusian cloud services provider ActiveCloud was hit by a ransomware attack earlier this week, disrupting corporate websites, email services and virtual servers used by businesses across the country, the company said.

The incident is the latest cyberattack targeting hosting providers in Belarus and neighboring Russia in recent weeks.

ActiveCloud said hackers had breached its systems and encrypted parts of its cloud infrastructure, leaving customers unable to access key services, including cloud hosting platforms, corporate email systems and customer support channels.

The company said Friday that it had restored its main services but was still working to resolve problems affecting individual customers.

"These have been difficult days," ActiveCloud said. "Our team has been working at full capacity, and today we can say that the most challenging phase is behind us."

The company first disclosed the attack Tuesday. By Wednesday, it had restored key parts of its infrastructure but said bringing all customer systems back online would take longer than initially expected.

ActiveCloud said its investigation had found no evidence that customer data had been stolen during the attack. It has not identified the hackers or explained how they gained access to its systems.

Among those affected was the Belarusian news outlet Smartpress, which confirmed that its website was hosted on ActiveCloud's infrastructure. The outlet continued publishing news despite the disruption.

The website and mobile app of Domino's Pizza in Belarus also experienced temporary outages linked to technical problems, according to local media reports.

ActiveCloud provides cloud hosting, virtual servers, corporate email and other IT infrastructure services to businesses and organizations in Belarus and Russia.

The attack affected several of its products, including E-Cloud, its main cloud hosting platform; E-Cloud Protected, a service offering additional security protections; and SmartMail, its corporate email service.

Although most services are now operational, the company warned that some customers may still have difficulty restoring their virtual machines.

The incident follows two major cyberattacks against hosting providers in neighboring Russia earlier this month.

On November 8, Russian hosting company ESTT faced a ransomware attack that disrupted its cloud infrastructure, leaving customers unable to access websites, virtual servers and other online services. The company said hackers had targeted its cloud management systems but that it had found no evidence of customer data theft.

Days earlier, another Russian hosting provider, Beget, suffered a destructive cyberattack in which hackers gained access to infrastructure management systems and deployed scripts that wiped data from parts of its cloud environment.

The attack disrupted websites and online services used by businesses, news organizations and government agencies. Beget said some virtual server backups had been lost, complicating recovery efforts and forcing the company to rebuild parts of its infrastructure.

There is no publicly confirmed evidence linking the attacks on ActiveCloud, ESTT and Beget, and none of the companies has identified those responsible.