[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$frvWhDSiqhZgrVXhDioYW8ZLuPFJBXpGg7LP4V_AZ0gY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"f4a6aed5-ba27-4031-b5e4-ea1ab70925f1","beget-hosting-cyberattack-wipes-cloud-data-and-backups","1f125f1e-2dc0-4033-9c1e-0705963de291","Beget Hosting Cyberattack Wipes Cloud Data and Backups","Attackers gained access to Beget's management systems, giving them the ability to erase data across virtual private servers, cloud storage, Kubernetes services, and binary backups in a single destructive campaign. The root failure was insufficient access control around critical management infrastructure, combined with backup systems that were reachable and destroyable by the same attacker who compromised production. This matters because hosting providers are custodians of thousands of customers' data, meaning a single breach can cascade into mass data loss at scale. The destruction of binary backups left only file-level backups, turning a recoverable incident into a prolonged, server-by-server restoration effort.","**Immediate actions:**\n- Isolate management and orchestration systems (e.g., Kubernetes control planes, hypervisor consoles) behind strict MFA and privileged access workstations.\n- Verify that backup systems are stored in a separate, air-gapped or immutable environment that cannot be accessed or deleted via production credentials.\n\n**Long-term improvements:**\n- Implement the 3-2-1-1 backup rule: three copies, two media types, one offsite, and one immutable\u002Foffline copy that is cryptographically protected from deletion.\n- Apply least-privilege principles and just-in-time (JIT) access for all administrative accounts managing cloud infrastructure.\n- Conduct regular red-team exercises specifically targeting management plane access to validate segmentation and detection controls.\n\n**Detection measures:**\n- Deploy alerting on mass-deletion or bulk API calls against storage, VPS, and backup systems to catch destructive actions before they complete.\n- Maintain out-of-band logging shipped to an immutable SIEM that cannot be wiped by the same credentials used in production management.",[12,13,14,15,16,17,18],"CIS Control 6: Access Control Management","CIS Control 11: Data Recovery","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"CIS Control 11: Data Recovery":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"CIS Control 6: Access Control Management":23,"CIS Control 17: Incident Response Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 explicitly requires incident handling and business continuity measures including backup management, which Beget's destroyed binary backups demonstrate were insufficiently protected and segmented.","Binary backups were wiped alongside production data because they shared the same access plane; this control requires maintained, tested backups that are isolated from primary systems.","If the management system access was gained through an unpatched vulnerability, timely flaw remediation processes would have closed the initial entry point.","Attackers pivoted through management systems unchecked; enforcing least privilege and MFA on privileged accounts would have restricted the blast radius of compromised credentials.","The need for individual server inspection during recovery indicates an absence of a pre-planned, rehearsed incident response procedure for large-scale destructive attacks.","Regular vulnerability assessments of management and orchestration interfaces would have identified and reduced the attack surface exploited to gain destructive access.","Gaining access to management systems was the pivotal enabler; strong identity controls and privileged access management would have prevented lateral movement to destructive capabilities.","published","2026-11-04T14:20:24.309435+00:00","2026-11-04T14:20:24.292+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Ftherecord.media\u002Frussia-cyberattack-beget-cloud","cyberattack-wipes-cloud-data-at-major-russian-hosting-provider-beget-b785d9","Cyberattack wipes cloud data at major Russian hosting provider Beget",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8ff5d73-dec9-4911-88ee-ed016a89f3f4","Backup & Recovery","backup-recovery","No backups, untested recovery, ransomware impact","#f43f5e",[],[49,53,57],{"slug":50,"name":51,"problem":52},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":54,"name":55,"problem":56},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",{"slug":58,"name":59,"problem":60},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it."]