Security · October 23, 2026
Hackers breached Russian hosting providers via VMmanager flaw, exposing client data
Hackers compromised the infrastructure of several Russian hosting providers and deployed data-stealing malware on their servers. The attackers exploited a vulnerability in the VMmanager 6 virtual server management system, which allowed them to access client passwords, SSH keys, cloud service access tokens, and other sensitive information. FirstVDS and other hosting providers reported the incidents.
The data-stealing program mounted client virtual server disks in read-only mode and copied files from them. Compromised data may have included passwords, SSH keys for remote server access, cloud service access tokens, configuration files, command history, cryptocurrency wallets, and user documents. In one case, data was accessed between 12:27 and 22:34 on October 17.
The infection of VMmanager panels occurred between October 11 and 16, detected by the cloud provider ForestsNet Cloud, with the active phase of the attack unfolding overnight from October 16 to 17. The attackers had obtained lists of servers and their IP addresses, client email addresses, administrator passwords, and remote server management passwords via VNC console. The hosting provider found no traces of data theft on its nodes but was unable to rule out access.
Astra Group confirmed awareness of the incident. The company stated it is conducting an investigation and in contact with customers. Since the issue involves the security of specific infrastructures and customers using the platform in an open information environment, they are not disclosing the list or number of affected operators, nor details of how access may have been obtained. This is standard practice, as revealing such details before updates are applied to all customers creates additional risks. All necessary measures to eliminate the causes and consequences of the attack are being taken, the investigation continues, and technical support is assisting with specific installations. The fixes have already been released and should be installed promptly. No hacker group has claimed responsibility for the attack.
VMmanager was originally developed for hosting providers but later expanded to the corporate market, with different functionality for each group. The vulnerability was in the hosting provider version, which is why they reported the incidents. Astra Group did not develop VMmanager from the start, having acquired ISPsystem along with the project in 2022. Among VMmanager clients beyond hosters are medical centers of the Ministry of Health, the Tomsk Regional Multidisciplinary Trauma Center, Ural Federal University, Alef-Bank, and other organizations.