Hackers steal customer data from major Russian hosting provider FirstVDS

Hackers have stolen passwords, access credentials and other sensitive data belonging to customers of Russian hosting provider FirstVDS after exploiting a vulnerability in software used to manage its servers, the company said over the weekend.

The attack, discovered on Saturday, affected part of FirstVDS's infrastructure, allowing the hackers to access data stored on customers' virtual servers without disrupting their operations. 

According to the company, the attackers exploited a vulnerability in VMmanager 6, a virtualization management platform developed by Russian software company ISPsystem. The platform allows hosting providers to manage virtual machines across multiple physical servers.

The hackers then deployed malware that allowed them to copy data from customers' virtual servers, including passwords, cloud service credentials, configuration files, cryptocurrency wallets and other files. The stolen information was transferred to a server controlled by the attackers, according to FirstVDS.

The company said the breach affected only some of its infrastructure but did not disclose how many customers or servers were compromised.

FirstVDS, which has operated since 2002, is one of Russia's oldest hosting providers. It rents virtual private servers that customers use to run websites, applications, databases and other online services. The company also offers servers hosted outside Russia, including in the Netherlands and Kazakhstan.

According to FirstVDS, the attackers were able to access customer data without directly compromising the virtual machines themselves. Instead, the malware mounted their disks in read-only mode, allowing it to copy information without modifying files or disrupting normal operations.

“As a result, there are no traces of the attack on the affected virtual servers, which continue to operate normally,” the company said.

FirstVDS warned customers who received breach notifications to assume that data stored on their servers had been stolen and urged them to change passwords and access credentials.

The company said it had disabled external access to the vulnerable management system and blocked communications with the attackers' server.

ISPsystem has released several patches since the breach, including an update deployed overnight on Monday, but the vulnerability has not yet been fully fixed, according to FirstVDS.

The software vendor has advised against restoring access to the management interface until additional security updates are available.

As of Monday, FirstVDS was still operating with some restrictions, including limited availability of VMmanager functions, according to its service status page.

The company has not disclosed how the attackers initially exploited the vulnerability, which versions of the software were affected or whether the stolen data has been used in further attacks. The identity and motives of the hackers remain unknown.