Beget Cloud Wiper Attack: Management Plane Breached, Data Erased, VPS, S3, and Kubernetes Infrastructure Rebuilt

1. Basic Information

• Article Title: Russian cloud firm Beget rebuilds from scratch after data wiper attack
• Publisher: BleepingComputer
• Publication Date: 2026-11-09
• Collection Date: 2026-11-10T07:46:16+09:00
• Source: BleepingComputer
• Related Sources: Beget official security incident page
• Related Products and Technologies: Beget Cloud, VPS, S3, Kubernetes, CDN
• Severity: Critical
• Severity Justification: Attackers compromised the cloud management plane and executed malware that deleted server data, causing data loss across the cloud infrastructure, including VPS, S3, and Kubernetes, and forcing a full rebuild.

2. Quick Summary

Attackers broke into Beget Cloud's management servers and ran scripts to zero out data. Beget disconnected all servers, but lost cloud infrastructure data and binary backups for VPS. As of November 6, Beget estimated that it could provide file backups for only about half of VPS users.

3. Attack Flow

1. Attackers gain access to the cloud management servers.
2. They execute data-zeroing malware from the management plane.
3. After the deletion process, the loss of VPS, S3, and Kubernetes data, CDN and IP configurations, and VPS binary backups is confirmed (specific destruction paths have not been publicly disclosed).
4. The provider disconnects all servers and rebuilds in a clean environment.

4. Attacker Position and Execution Location

• Attackers obtained unauthorized access to the management servers. The initial access vector has not been disclosed.
• Data exfiltration was not confirmed, while successful data destruction was confirmed.

5. Victim and Administrator Perspective

Victim Perspective

• Affected users experience VPS, object storage, Kubernetes, and CDN service outages, along with data loss.

Administrator Perspective

• On the provider side, management server compromise, deletion execution, and data loss were confirmed, along with the network disconnection (containment) of all servers.
• Users can only observe the stoppage of their workloads and data loss; they cannot observe internal provider processes or the deletion operations themselves.

6. Success and Failure Conditions

Success Conditions

• Gaining management server privileges.
• Reaching both production and backup environments with destructive operations.

Failure Conditions and Countermeasures

• Prevention and Scope Limitation: Isolate the management plane and require multi-party authorization for destructive operations.
• Recovery: Immutable or offline backups do not prevent the deletion of production data, but can support recovery if they remain intact and usable and restoration procedures have been tested. Do not reuse compromised control planes; perform a clean rebuild.

7. What Happens Upon Success

• Massive data loss of cloud workloads and configurations.
• Extended service downtime and manual rebuilding.

8. Observable Logs

The following items are general investigation candidates. Beget's published observations fall under Section 5, and specific log specifications have not been provided. Check each item if telemetry is collected in the target system.

• Email: No email-based initial vector has been publicly disclosed.
• Proxy/SWG/DNS: Check for connections to Beget Cloud from unknown sources.
• Endpoint/EDR: Check for suspicious processes, files, and child processes related to Beget Cloud.
• Identity/IdP: Check account logins, token generation, and permission changes.
• SaaS/Cloud: Check management APIs, object access, and configuration changes.
• Network: Check for anomalous requests and subsequent communications.

9. Attack Success Assessment

Subsequent Compromise Confirmed

• Public Information: Beget confirmed management server compromise, data zeroing, and cloud infrastructure data loss.
• Scope of Confirmation: Limited to Beget's incident timeline and recovery status.

10. Investigation Playbook

• Trigger: Use mass deletion, storage errors, and multiple offline nodes as triggers.
• Initial Check: Check versions, exposure, sources, accounts, and the initial anomaly timestamp.
• Endpoint: Preserve process trees, files, memory, and persistence mechanisms.
• Authentication and Cloud: Check the creation and usage of accounts, tokens, and secrets.
• Subsequent Operations: Investigate subsequent commands, data access, and lateral movement.
• Containment: Isolate services, apply patches, revoke credentials, and perform clean rebuilds as necessary.
• Assessment Categories: Separate access, wiper execution, production destruction, backup destruction, and unrecoverable states.

11. Defense and Detection Ideas

• Single Event: Detect rapid mass deletion, disk zeroing, and backup deletion with high priority.
• Timeline Correlation: Correlate initial access, privilege acquisition, subsequent commands, and data access along a timeline.
• Hunting: Search for deletion APIs, storage wipe utilities, backup catalog modifications, and missing CDN/IP configurations.
• Logging Gaps: Combine asset, account, and network telemetry when public IOCs or detailed logs are unavailable.
• Priority Controls: Prioritize immutable/offline backups, management plane isolation, and multi-party authorization for destructive actions.

12. Facts, Inference, and Hypothesis

Facts

• Attackers are estimated to have accessed the management servers on November 2 at 02:00 (Moscow time, same below) and launched data deletion malware at 02:30.
• Detection is estimated to have occurred at 02:40, with all servers disconnected from the network by 02:55.
• Data for VPS, S3, and Kubernetes, CDN and IP configurations, and VPS binary backups were lost.
• As of November 6, Beget estimated that it could provide file backups for about half of VPS users and explained that manual inspection of over 1,000 servers was required.
• Beget stated that it had found no evidence of data downloads or tampering and that the attack was intended to destroy data.

Inference

• Shared controls between the management plane and backup plane may have amplified the impact of simultaneous loss.

Hypothesis

• No additional hypotheses.

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1485	Data Destruction	High	Beget reported the execution of data-zeroing malware and the loss of cloud infrastructure data. VPS binary backups were also lost, but the specific mechanism of backup destruction has not been disclosed.
T1490	Inhibit System Recovery	Medium	The loss of VPS backups was reported, but specific destructive actions against backups remain unpublicized, thus inferred from the loss.

14. Unknowns and Further Investigation

• Initial intrusion vectors, attacker attribution, malware hashes, and per-user recovery feasibility remain unpublicized.

15. Impact on SOCs and Organizations

When production systems and backups depend on the same management plane, a destructive attack may affect both if the attacker can carry out destructive operations against both environments. Assume control plane compromise in recovery exercises, and test clean-room rebuild procedures and the independence of backups.

16. Summary by Target Audience

• For SOCs: Track incidents from management plane intrusion to mass deletion and backup destruction.
• For Administrators: Verify immutable backups, separate credentials, multi-party authorization, and clean rebuild procedures.
• For Users: Confirm the provider's recovery status and your own backups.