[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f37zKUWLxfnLdH5O1ivTAzn6FRMWjIutVF8IzmnTxzpM":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"1f125f1e-2dc0-4033-9c1e-0705963de291","Cyberattack wipes cloud data at major Russian hosting provider Beget","cyberattack-wipes-cloud-data-at-major-russian-hosting-provider-beget-b785d9","A major Russian web hosting provider is struggling to restore its services after a cyberattack destroyed data across its cloud infrastructure and disrupted hundreds of websites.","A cyberattack has severely impacted Beget, a major Russian web hosting provider, destroying data across its cloud infrastructure and disrupting hundreds of websites. The attackers gained access to management systems, enabling them to erase data from virtual private servers, cloud storage, and Kubernetes services, and also wiped binary backups. While file-level backups remain, recovery is expected to be a lengthy process requiring individual server inspection.","Cyberattack destroys data at Russian web hosting provider Beget, impacting hundreds of websites.","https:\u002F\u002Ftherecord.media\u002Frussia-cyberattack-beget-cloud","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002FBeget_de93fe90b7.jpg","2026-11-04T14:00:00+00:00","2026-11-04T14:00:15.180194+00:00",7,[17,20,22,24,26,28],{"name":18,"type":19},"Beget","vendor",{"name":21,"type":19},"FirstVDS",{"name":23,"type":19},"Yandex",{"name":25,"type":19},"Sberbank",{"name":27,"type":19},"VK",{"name":29,"type":30},"Kubernetes","technology","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":31,"icon":33,"name":34,"slug":35},null,"Breaches","breaches",[37,39,44,49],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21,23],{"controls":57,"vendors":141},[58,87,116],{"slug":59,"name":60,"problem":61,"products":62},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":88,"name":89,"problem":90,"products":91},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[92,100,108],{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"slug":117,"name":118,"problem":119,"products":120},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[121,125,133],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":48,"product_name":122,"url":123,"description":124},"CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",[],{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":154},"beget-hosting-cyberattack-wipes-cloud-data-and-backups","Beget Hosting Cyberattack Wipes Cloud Data and Backups","Attackers gained access to Beget's management systems, giving them the ability to erase data across virtual private servers, cloud storage, Kubernetes services, and binary backups in a single destructive campaign. The root failure was insufficient access control around critical management infrastructure, combined with backup systems that were reachable and destroyable by the same attacker who compromised production. This matters because hosting providers are custodians of thousands of customers' data, meaning a single breach can cascade into mass data loss at scale. The destruction of binary backups left only file-level backups, turning a recoverable incident into a prolonged, server-by-server restoration effort.",[147,148,149,150,151,152,153],"CIS Control 6: Access Control Management","CIS Control 11: Data Recovery","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":155,"CIS Control 11: Data Recovery":156,"NIST SP 800-53 SI-2: Flaw Remediation":157,"CIS Control 6: Access Control Management":158,"CIS Control 17: Incident Response Management":159,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":160,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":161},"NIS2 explicitly requires incident handling and business continuity measures including backup management, which Beget's destroyed binary backups demonstrate were insufficiently protected and segmented.","Binary backups were wiped alongside production data because they shared the same access plane; this control requires maintained, tested backups that are isolated from primary systems.","If the management system access was gained through an unpatched vulnerability, timely flaw remediation processes would have closed the initial entry point.","Attackers pivoted through management systems unchecked; enforcing least privilege and MFA on privileged accounts would have restricted the blast radius of compromised credentials.","The need for individual server inspection during recovery indicates an absence of a pre-planned, rehearsed incident response procedure for large-scale destructive attacks.","Regular vulnerability assessments of management and orchestration interfaces would have identified and reduced the attack surface exploited to gain destructive access.","Gaining access to management systems was the pivotal enabler; strong identity controls and privileged access management would have prevented lateral movement to destructive capabilities."]