Attackers exploited a vulnerability in ISPsystem’s VMmanager 6 platform to copy files from customer virtual servers operated by Russian hosting provider FirstVDS. The stolen material included passwords, cloud service credentials, configuration files and cryptocurrency wallets, according to company statements reported by The Record.
FirstVDS discovered the intrusion on Saturday and announced it over the weekend. The company said only part of its infrastructure was affected, but did not provide a count of customers, servers or people involved.
Customers who receive a breach notification should assume that data stored on their servers was stolen, FirstVDS warned. They should change passwords and replace exposed access credentials rather than relying on the continued availability or apparently normal operation of their virtual machines.
Attackers mounted virtual disks without disrupting servers
VMmanager 6 is an ISPsystem virtualization management platform that hosting companies use to administer virtual machines distributed across physical servers.
According to FirstVDS, malware abused the management platform to mount customers’ virtual server disks in read-only mode. This allowed the attackers to copy files without changing their contents or interrupting the running services. The exfiltrated data was then sent to infrastructure controlled by the attackers.
FirstVDS said the virtual machines themselves were not directly compromised and claimed there were “no traces” of the attack on the affected servers, which continued to operate normally. That description does not reduce the confidentiality impact: a read-only mount can leave customer workloads running while still exposing credentials and other sensitive files.
The provider offers servers in Russia, the Netherlands and Kazakhstan. The reported account does not specify which hosting locations were included in the affected portion of its infrastructure.
The vulnerability is not yet fully fixed, FirstVDS says
FirstVDS disabled external access to the vulnerable management system and blocked communications with the attackers’ server. It also said ISPsystem had released several patches following the breach, including an update deployed overnight on Monday.
However, FirstVDS reported that the vulnerability was not yet fully resolved. ISPsystem advised operators not to restore access to the management interface until additional security updates become available.
As of Monday, FirstVDS was still operating under restrictions, including reduced availability of some VMmanager functions. The affected VMmanager 6 versions and specific corrected build numbers were not identified in the reported statements, limiting administrators’ ability to determine exposure from a version check alone.
Notified customers should rotate exposed credentials
The immediate action for notified FirstVDS customers is to treat server contents as copied. Password changes alone may be insufficient if the server stored other reusable credentials, configuration secrets or cloud access data; those credentials should also be replaced in the services where they remain valid.
Cryptocurrency wallet files and configuration data require particular attention because copying them may create risks outside the affected virtual server. The reported statements do not establish whether the stolen information has been used in subsequent attacks.
Hosting operators using VMmanager 6 should follow ISPsystem’s instruction to keep the management interface inaccessible while waiting for further security updates. Restoring external access before the vendor considers the issue fully addressed could leave the vulnerable administrative layer exposed again.
