FirstVDS Customers Exposed After Attackers Exploit VMmanager Flaw

Russian hosting provider FirstVDS confirmed over the weekend that attackers stole sensitive customer data after exploiting a flaw in its server management infrastructure. The breach was discovered on Saturday and involves the compromise of passwords, access credentials, and other confidential information belonging to clients using the company’s virtual private servers.

The intruders targeted VMmanager 6, a virtualization platform developed by ISPsystem that allows hosting providers to administer virtual machines across physical hardware. According to FirstVDS, the attackers used this vulnerability to install malware on the management layer. This software allowed them to mount customer disks in read-only mode, enabling the theft of data without altering files or interrupting normal service continuity.

Attack Mechanics and Scope

FirstVDS stated that the breach affected only a portion of its infrastructure, though it did not specify the number of compromised servers or customers. The company operates virtual private servers for websites, applications, and databases, with facilities in Russia, the Netherlands, and Kazakhstan. Because the malware accessed data at the disk level rather than inside the virtual machines, affected servers showed no signs of intrusion and continued running normally.

The stolen data was transferred to a server controlled by the threat actors. FirstVDS reported that the attackers copied passwords, cloud service credentials, configuration files, and cryptocurrency wallets. The company emphasized that the virtual machines themselves were not directly compromised, meaning the attack vector relied entirely on the management platform’s exposure.

Vendor Response and Status

FirstVDS has taken immediate steps to contain the incident by disabling external access to the vulnerable VMmanager 6 system. The company also blocked communications with the attacker-controlled server to prevent further data exfiltration. Despite these measures, FirstVDS noted that the underlying vulnerability in the software has not yet been fully resolved.

ISPsystem, the developer of the management platform, has released several patches since the breach was discovered, including an update deployed overnight on Monday. However, FirstVDS clarified that these updates do not completely fix the security flaw. Customers who received breach notifications were advised to assume their stored data has been stolen and to change all relevant passwords and access credentials immediately.

What should you do?

FirstVDS urges all customers who received breach notifications to treat their server data as compromised. The company recommends changing all passwords and access credentials associated with the affected accounts. Users should also review configuration files and cloud service credentials for any unauthorized changes or exposures.

What to do and how to stay safe: FirstVDS

• Rotate all passwords and access credentials for any services hosted on or accessible from potentially compromised virtual servers.
• Monitor cloud service accounts and cryptocurrency wallets for unauthorized activity or login attempts from unfamiliar locations.
• Check system logs and file integrity on virtual machines for any signs of modification, even though the primary attack was read-only.
• Wait for official confirmation from the software vendor that the specific vulnerability in the management platform has been fully patched before restoring full external access.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Did the attack disrupt the operation of the affected virtual servers?

No, FirstVDS stated that the servers continued to operate normally because the malware accessed data in read-only mode without modifying files.

Has the vulnerability in VMmanager 6 been fully fixed?

No, although ISPsystem released patches including one on Monday, FirstVDS confirmed the vulnerability has not yet been fully resolved.

What specific types of data were stolen in the breach?

Attackers stole passwords, cloud service credentials, configuration files, cryptocurrency wallets, and other sensitive files from customer servers.