# Russian Hosting Provider FirstVDS Breached via VMmanager 6 Vulnerability **FirstVDS**, a prominent Russian hosting provider, has disclosed a significant data breach. The incident, discovered over the weekend, allowed hackers to exfiltrate passwords, access credentials, and other sensitive information from customer virtual servers. ## The Attack Vector: VMmanager 6 Vulnerability The breach stemmed from an exploited vulnerability within **VMmanager 6**, a virtualization management platform developed by Russian software company **ISPsystem**. This platform is widely used by hosting providers to manage virtual machines across numerous physical servers. Attackers leveraged this flaw to deploy malware, which then copied data from customer virtual servers. This stolen information included critical assets such as passwords, cloud service credentials, configuration files, and cryptocurrency wallets. The data was subsequently transferred to an attacker-controlled server. ## Stealthy Data Exfiltration Notably, the attackers managed to access customer data without directly compromising the virtual machines themselves. Instead, the malware mounted the disks in read-only mode, facilitating data copying without altering files or interrupting normal operations. **FirstVDS** stated, "As a result, there are no traces of the attack on the affected virtual servers, which continue to operate normally." While **FirstVDS** confirmed that only a part of its infrastructure was affected, the company has not yet disclosed the exact number of compromised customers or servers. **FirstVDS**, operational since 2002, is one of Russia's oldest hosting providers, offering virtual private servers both within Russia and in locations like the Netherlands and Kazakhstan. ## Remediation Efforts and User Advisories In response to the breach, **FirstVDS** has disabled external access to the vulnerable management system and blocked communications with the attackers' server. Customers who received breach notifications have been strongly advised to assume their data has been stolen and to change all passwords and access credentials immediately. **ISPsystem** has released multiple patches since the breach, including an update deployed on Monday. However, **FirstVDS** indicates that the vulnerability is not yet fully remediated. The software vendor has recommended against restoring access to the management interface until further security updates are available. As of Monday, **FirstVDS** continues to operate with some restrictions, including limited functionality of **VMmanager** features, as detailed on its service status page. The company has not yet revealed how the vulnerability was initially exploited, which software versions were affected, or if the stolen data has been used in subsequent attacks. The identity and motives of the hackers remain unknown.