Russian cloud services provider Beget is currently engaged in a massive infrastructure recovery effort following a destructive cyberattack that occurred on the night of November 1. The company, which provides web hosting, domain registration, and cloud services to over 200,000 customers, confirmed that an unauthorized actor gained access to its primary management systems and deployed data-wiping malware. This incident resulted in the widespread deletion of data across the firm's architecture, forcing the organization to rebuild its cloud environment from the ground up.
Upon detecting the activation of the malicious scripts, Beget disconnected its servers from the network in an attempt to halt the spread of the wiper. Despite these efforts, the company reported that the attacker successfully executed data-zeroing commands that impacted its entire cloud infrastructure, including Virtual Private Servers (VPS), S3 storage, and Kubernetes clusters. Additionally, the breach resulted in the loss of critical CDN settings and IP configurations.
The company has officially confirmed that its binary backups for VPS environments were completely destroyed during the attack. While some file-based backups survived, the firm’s assessment as of November 6 indicates that these will only be available for roughly half of its VPS user base. Beget has characterized the process of identifying and restoring these surviving backups as a technically complex task that will require significant time to complete.
Regarding the scope of the restoration, Beget reported that as of November 9, approximately 60 percent of its shared hosting services and 40 percent of its dedicated servers had been brought back online. The recovery process remains ongoing, with the company treating its entire infrastructure as potentially compromised. To ensure security, technical teams are performing manual vulnerability checks and hunting for hidden scripts on approximately 1,000 servers before they are permitted to reconnect to the network.
Beget has stated that its internal investigation found no evidence that the attacker attempted to exfiltrate, download, or modify customer data prior to the deletion. The company maintains that the incident appears to have been motivated solely by the intent to cause destruction. The firm is currently reworking all potentially vulnerable points in its architecture, including components that were previously considered low-risk.
In response to the incident, Beget has engaged external cybersecurity firms to assist with the remediation and recovery process. The company has also formally notified Russian law enforcement and relevant government agencies regarding the breach. While the provider is working to restore services as quickly as possible, it has acknowledged that a full recovery of all data is not possible given the nature of the wiper attack.
