Several Russian hosting providers, FirstVDS among them, have reported a breach. The way in was a flaw in VMmanager 6, the panel a host uses to run its customers' virtual servers. The panel is made by ISPsystem, part of Astra Group since 2022.

According to ForestsNet Cloud, the panels were infected between 11 and 16 October, and the main phase ran overnight from the 16th to the 17th. The malware mounted client VPS disks read-only and copied files off them: SSH keys, passwords, cloud tokens, config files, shell history. The attackers already held server lists with IP addresses, customer emails, and VNC console passwords.

Who has to care

Anyone whose site, bot or CRM runs on a rented VPS/VDS at a host that uses VMmanager. It is easy to check: look at which panel you use to reboot the server in your account, or simply ask support. Astra Group has confirmed the incident and shipped fixes, but will not say which providers were hit.

The unpleasant part: from the outside nothing may have changed. Files were read, not modified, so the site loads as usual and you will not notice anything odd. That is not a reason to assume you were spared.

What to do now

  • Ask your host whether your node was affected, and get the answer in writing
  • Reissue SSH keys and change the passwords for root and other server users
  • Revoke and recreate tokens: cloud, S3, payment gateway, Telegram bot, mailing APIs
  • Change the database password and the secrets in .env, then restart the app
  • Check authorized_keys for keys you do not recognise and cron for unfamiliar jobs

A Telegram bot token is reissued in @BotFather with the /revoke command. The old one stops working immediately, so put the new one into the config right away or the bot goes silent.

Our take

A host is a contractor with its own supply chain, and a hole in someone else's panel quickly becomes your problem. Two simple habits help: never type secrets on the command line, where they end up in shell history, and keep a list of which key is used where. On the day of an incident that list saves hours. The original report ran on 3DNews; the link is also below.