Science & Tech · Cybersecurity · 3 hrs ago
Hackers steal data from FirstVDS customers through VMmanager 6 flaw
Hackers accessed part of Russian hosting provider FirstVDS’s infrastructure on October 17 through a vulnerability in VMmanager 6, software used to manage virtual servers.
The attackers copied data from customers’ virtual servers, including passwords, access keys, configuration files, cryptocurrency wallets and user files.
VMmanager 6 is made by ISPsystem, part of Russian software group Astra, and is used by hosting providers and other organizations.
More than 6,000 servers were listed as using the platform, but that figure does not show how many were affected; FirstVDS and Astra have not disclosed the number.
FirstVDS said the stolen data was copied without disrupting the virtual servers, and warned customers who received notifications to change passwords and access credentials.
FirstVDS restricted access to the vulnerable system, while ISPsystem released software updates; FirstVDS said some restrictions remained and the vulnerability was not fully fixed as of Monday.
Hackers exploited a vulnerability in VMmanager 6 to access part of hosting provider FirstVDS’s infrastructure and steal customer data.
The stolen data could include passwords, access keys, cloud-service tokens, configuration files, cryptocurrency wallets and user files.
FirstVDS said the attackers copied data from virtual-server disks in read-only mode, without disrupting the servers’ operations.
The company did not disclose how many customers or servers were affected.
ISPsystem, which develops VMmanager 6 and is part of Russia’s Astra Group, confirmed an incident involving a vulnerable software build.
- Who
- Hackers accessed FirstVDS infrastructure and stole customer data. The attackers’ identities are unknown.
- What
- They exploited a VMmanager 6 vulnerability and copied data from some customers’ virtual servers.
- When
- FirstVDS said access was gained on October 17, 2026. The breach was discovered on Saturday.
- Where
- Part of FirstVDS’s hosting infrastructure. The company said its FirstVDS.CLO cloud platform was not affected.
- Why
- The hackers exploited a vulnerability in a build of VMmanager 6. Their motive is not stated.
This story does not have two clearly opposing sides.
FirstVDS said hackers gained access to part of its infrastructure through a VMmanager 6 vulnerability.
FirstVDS warned affected customers and said attackers had deployed data-stealing software.
ISPsystem deployed an update, though FirstVDS said the vulnerability was not yet fully fixed.
- Affected provider
- FirstVDS
- Vulnerable software
- VMmanager 6
- Potential scale
- More than 6,000 servers were reported as using VMmanager
- Data copied
- Passwords, access keys, tokens, configuration files, cryptocurrency wallets and user files
- Cloud platform
- FirstVDS said FirstVDS.CLO was not affected
- Developer
- ISPsystem, part of Astra Group
4 sources
Хакеры взломали сервис управления серверами российской суверенной операционной системы для госсектора
Российская система управления серверами взломана. Под угрозой тысячи серверов в госучреждениях и частных фирмах
Под угрозой более 6 тысяч государственных и бизнес серверов: хакеры атакуют через уязвимость VMmanager 6 от ГК «Астра»
Hackers steal customer data from major Russian hosting provider FirstVDS
What people are saying
As a result, there are no traces of the attack on the affected virtual servers, which continue to operate normally.
Therefore, a hole at one vendor automatically becomes a problem for the entire VPS market.
All secrets should be considered compromised and reissued.