22OCT

FirstVDS loses client data via VMmanager

2 min read

16:31UTC

Russian host FirstVDS says attackers used a flaw in ISPsystem's VMmanager 6 to open customers' server disks and copy passwords, cloud credentials and crypto wallets. The servers themselves show no trace.

← Back to Fridge hack spoils food in seven countries Jump to analysis ↓

TechnologyDeveloping

Key takeaway

FirstVDS customers cannot see the theft on their own servers, because it ran from the layer beneath.

Russian hosting provider FirstVDS said over the weekend of 17 to 18 October that attackers exploited a flaw in VMmanager 6, the ISPsystem software hosts use to run many customers' rented servers on one machine. The intruders opened those customers' disks read-only and copied passwords, cloud credentials, configuration files and cryptocurrency wallets⁠¹. "There are no traces of the attack on the affected virtual servers," FirstVDS said; the copying ran from the management layer beneath them.

The flaw was not fully fixed on 19 October, and ISPsystem advised hosts not to restore management-interface access until more updates ship. A customer checking its own server would find nothing, so the safe assumption for anyone hosted there is that every secret on the disk needs replacing. Copied credentials keep their value long after the break-in: SOCRadar tied FortiGate credentials stolen earlier to the Lynx/INC Ransom operation, which cracked the passwords offline. Separately, Russian online travel agency Anywayanyday halted new air, rail and hotel bookings on 14 October after an attack on its IT systems⁠².

Deep Analysis

In plain English

FirstVDS rents out virtual servers: slices of a big computer that customers use to run websites and apps. Attackers broke into the software FirstVDS uses to manage those slices. They copied customers' passwords, cloud keys and cryptocurrency wallets straight off their disks. Because the copying happened underneath the customers' servers, those servers show no sign of it. Customers should change every password and key stored on them. A Russian travel booking site, Anywayanyday, was hit separately.

Deep Analysis

Root Causes

Hypervisor management software can mount any tenant's disk, because hosts need that power for backups and recovery. A flaw in that layer bypasses every control a customer sets inside their own server.

Many customers store credentials, configuration files and wallets unencrypted inside rented servers, trusting the host's isolation. A read-only disk mount from below exposes all of it.

What could happen next?

Risk
Cloud credentials copied from FirstVDS customer disks can give attackers access to services well beyond the hosting provider.
Consequence
Hosts running VMmanager 6 must keep management interfaces offline until ISPsystem ships further updates, limiting their own operations.

Source Landscape

This story draws on neutral-leaning sources

Primary parallel: The N-central intrusions in August showed attackers using a management platform to reach every machine it administers. VMmanager plays the same role for a hosting company's tenant servers.

Counter-parallel: The cPanel flaw in April also hit hosting control software, but attackers there deployed ransomware on hosts. At FirstVDS they copied secrets quietly, which delays detection and keeps the stolen credentials useful for longer.

Consensus view: FirstVDS says the copying ran from the VMmanager 6 management layer and left no traces on customers' virtual servers, so customers cannot detect the theft from inside their own machines. Every password, cloud key and wallet on an affected disk has to be treated as stolen.

Counter-view: ISPsystem's advice to keep management interfaces offline until more updates ship shows the vendor does not regard its first fix as complete. FirstVDS's disclosure is the only one reported so far, so other hosts running VMmanager may have been hit without saying so.

Key tension: Whether the attackers targeted FirstVDS alone or swept every VMmanager panel they could reach.

Sources:The Record·The Record

Mentions:Russia →SOCRadar →INC Ransom →Lynx →N-central →FirstVDS →VMmanager 6 →ISPsystem →Anywayanyday →

First Reported In

Update #15 · Fridge hack spoils food in seven countries

The Record· 22 Oct 2026

Read original →

Different Perspectives

Hospital Sírio-Libanês

Hospital Sírio-Libanês said a 21 September attack reached a reporting system for its social projects, possibly exposing patients' and staff identity numbers and health information, while its general patient database was untouched. It notified the ANPD and the Polícia Federal and warned of fraud attempts.

The Foschini Group

The Foschini Group told the Johannesburg exchange on 13 October that an attack found on 11 October disrupted IT systems at its TFG London brands, while stores stayed open. It has not identified the attackers or established whether personal data was taken.

FirstVDS

FirstVDS said attackers used a VMmanager 6 flaw to copy customers' passwords, cloud credentials and cryptocurrency wallets from beneath their virtual servers, and told notified customers to assume theft and rotate credentials. ISPsystem's flaw was not fully fixed on 19 October.

ESET

ESET says Russia-aligned UAC-0099 phished a Ukrainian grain logistics firm in July 2025 and apparently passed its access to GRU-linked Sandworm, which wiped the company's data that September. It treats the attackers' use of the Yggdrasil network as a first for a state-aligned actor.

JPCERT/CC

JPCERT/CC issued emergency alert AT-2026-0032 on 14 October as EG Secure Solutions confirmed attacks on the SiteGuard Server Edition flaw. It told operators to save diagnostic data before updating, because the update may erase traces of the attack.

Cyber Security Agency of Singapore

The Cyber Security Agency of Singapore said on 20 October that attackers are exploiting Ivanti Connect Secure, seven days after Ivanti's disclosure, having flagged PAN-OS exploitation on 16 October. It issued a PHP2Shell alert on 21 October, the day the fixes shipped.

Written with AI from Lowdown's published reporting. Not individually reviewed by an editor. Editorial standards.