[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbLEU6dtjLlzA1-TkUxbKcpEEnNJygxGytYrXzKh9kt0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"4664e4c4-2c59-4117-9832-573c0bec2045","beget-cloud-wiped-management-layer-compromise-destroys-200000-customers-data","a5c2f7bc-2bba-4aa1-926c-c5ee58a8f1df","Beget Cloud Wiped: Management Layer Compromise Destroys 200,000 Customers' Data","An attacker who gained access to Beget's cloud management layer deployed data-zeroing scripts that systematically destroyed VPS, S3, Kubernetes, and CDN data across the entire infrastructure, affecting over 200,000 customers. The root failure was a combination of insufficient access controls protecting the management plane and the absence of resilient, isolated backups that could have enabled full recovery. When a single management layer can reach and destroy all customer data simultaneously, the blast radius of any compromise becomes catastrophic. This incident illustrates that cloud providers—and their customers—must treat backup isolation and management-plane access control as existential priorities, not afterthoughts. The inability to fully recover data for many customers underscores that destruction-focused attacks demand a fundamentally different recovery posture than traditional ransomware scenarios.","**Immediate actions:**\n- Isolate management-plane credentials behind hardware MFA and privileged access workstations (PAWs) to prevent lateral movement from management systems to production data.\n- Audit all administrative accounts with access to bulk data operations and enforce just-in-time (JIT) access with time-limited tokens.\n\n**Backup & recovery hardening:**\n- Maintain at least one immutable, air-gapped or write-once backup copy of all customer data stored in a location logically and physically separate from the production management layer.\n- Implement and regularly test a tiered backup strategy (3-2-1-1: three copies, two media types, one offsite, one offline) with documented and rehearsed recovery runbooks.\n- Enforce backup integrity verification through automated checksums and periodic restore drills to confirm recoverability before an incident occurs.\n\n**Detection & containment measures:**\n- Deploy real-time anomaly detection on management APIs to alert on bulk delete, zero-write, or mass configuration change events that exceed normal operational thresholds.\n- Apply network segmentation so that management systems cannot directly reach storage backends without passing through an additional authentication and approval layer.",[12,13,14,15,16,17,18],"CIS Control 11: Data Recovery","CIS Control 6: Access Control Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","MITRE ATT&CK T1485: Data Destruction",{"NIS2 Article 21(2)(b)":20,"CIS Control 11: Data Recovery":21,"MITRE ATT&CK T1485: Data Destruction":22,"NIST SP 800-53 SI-2: Flaw Remediation":23,"CIS Control 6: Access Control Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 explicitly requires essential and important entities to implement incident handling and business continuity measures, including backup management; Beget's inability to fully restore customer data reflects gaps in the continuity requirements this article mandates.","This control mandates automated, tested, and isolated data backups; had Beget maintained immutable offsite backups unreachable from the management plane, full data recovery would have been possible rather than rebuilding 1,000 servers from scratch.","This technique describes adversaries deploying scripts or tools to overwrite or zero-out data to render it unrecoverable, precisely what was executed against Beget's storage infrastructure; detective controls and anomaly detection on bulk write operations are the recommended mitigations.","Timely identification and remediation of vulnerabilities in the management layer could have closed the initial entry vector before the attacker leveraged it to deploy destructive scripts.","Restricting privileged access to management systems through least-privilege principles and MFA would have made it significantly harder for the attacker to gain the management-layer foothold needed to execute the wiper at scale.","A structured vulnerability management program covering the management infrastructure would have reduced the attack surface available to the threat actor who compromised Beget's control systems.","Strong identity controls over the cloud management plane—including MFA and just-in-time privileged access—would have limited the attacker's ability to authenticate and execute bulk data destruction across all customer environments.","published","2026-11-09T18:20:46.798736+00:00","2026-11-09T18:20:46.782+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Frussian-cloud-firm-beget-rebuilds-from-scratch-after-data-wiper-attack\u002F","russian-cloud-firm-beget-rebuilds-from-scratch-after-data-wiper-attack-3b3799","Russian cloud firm Beget rebuilds from scratch after data wiper attack",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8ff5d73-dec9-4911-88ee-ed016a89f3f4","Backup & Recovery","backup-recovery","No backups, untested recovery, ransomware impact","#f43f5e",[],[49,53,57],{"slug":50,"name":51,"problem":52},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",{"slug":54,"name":55,"problem":56},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":58,"name":59,"problem":60},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it."]