One of Russia's largest domain registrars and hosting companies, **Beget**, confirmed on Wednesday that it had begun bringing some servers back online following a destructive cyberattack. The attack, which struck overnight on Sunday, saw attackers gain access to **Beget's** infrastructure management systems, enabling them to execute scripts designed to erase data. ### Extensive Damage to Cloud Services The impact was particularly severe on **Beget's** cloud infrastructure, where data associated with Virtual Private Servers (**VPS**), cloud storage, and **Kubernetes** services was wiped. The company also reported the loss of all binary backups for its virtual servers, although file-level backups remain intact, offering a potential avenue for some data recovery. **Beget** stated, "Restoring all services will take a considerable amount of time, as more than 1,000 servers must be manually inspected." The company affirmed its commitment to finding ways to recover the lost data. ### Escalating Cyber Landscape in Russia This incident is not isolated, occurring amidst a growing wave of cyberattacks and drone strikes targeting Russian digital infrastructure. In October, a vulnerability in software used by Russian hosting provider **FirstVDS** was exploited, leading to the theft of sensitive customer data, including passwords and cryptocurrency wallets. Furthermore, Ukrainian drones have targeted data centers operated by Russian tech giant **Yandex**, **Sberbank**, and social media giant **VK**, causing service disruptions across the country. ### Slow Recovery for Shared Hosting and Businesses While **Beget** anticipates that most websites hosted on its shared hosting infrastructure can likely be recovered, the process is expected to be slow due to the necessity of individually checking each server before bringing it back online. By Wednesday, some websites had been restored, with engineers actively removing malicious files and verifying data integrity. Dedicated servers directly managed by customers were reportedly restored earlier. The attack has disrupted numerous websites and online services throughout Russia, affecting businesses, government agencies, and research institutions. Notable outages included the official website of the Naryan-Mar city administration and Russia's **Chestny Znak** product labeling system. The Laboratory of Solar Astronomy at the Russian Academy of Sciences also reported its website was unavailable. Russian newspaper **Kommersant** highlighted that the disruption primarily impacted small and medium-sized businesses reliant on **Beget** for their online stores and corporate websites. ### Beget's Role and Security Posture Founded in 2007, **Beget** is a significant player in Russia's internet infrastructure, ranking second among registrars of Russian .RU domains with approximately 540,700 domains under management as of October. The company has stated it found no evidence of attackers attempting to download or modify customer data. However, it has urged customers to change passwords, access keys, and any other credentials that may have been stored on affected systems. **Beget** has not disclosed the initial access vector, citing security concerns and an ongoing investigation, and no hacking group has claimed responsibility. **Beget** also informed customers that the attack might be considered a force majeure event under Russian law, potentially impacting contractual obligations. Earlier this year, the European Union imposed sanctions on **Beget** and one of its co-owners, citing the company's provision of digital infrastructure services to Russian occupation authorities in Ukraine and its cooperation with Russian defense enterprises.