{"id":"CMP-202611-d3g4vi","kind":"campaign","aliases":[],"related":[],"title":"Russian hosting and cloud provider Beget hit by data-wiper attack: VPS, S3 and Kubernetes data wiped, some customer data cannot be recovered","description":null,"summary":"On the night of 1 Nov 2026 an attacker got into the management systems for Beget's whole infrastructure and ran malware that erased server data. Beget (Russian web hosting, cloud and domain registrar, 200,000+ customers) cut all servers off the network. Beget says all data in its cloud infrastructure was lost (VPS, S3, Kubernetes, CDN settings and IP configurations); VPS binary backups are completely lost, and file backups partly survived, for roughly half of VPS users (6 Nov update). More than a week later about 60% of shared hosting and 40% of dedicated servers had been restored; about 1,000 servers need manual checks for hidden scripts. Beget found no sign of data theft or changes; the attack looks aimed only at destruction. Attacker unknown, no claim of responsibility (BleepingComputer, 9 Nov).","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-09T18:30:40+00:00","products":[{"name":"Beget","fixed":[],"ecosystem":"saas"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Do you host sites, VPS, S3 storage, Kubernetes, CDN or domains at Beget (beget.com)? Check Beget's status page and whether your services and backups were restored. Data restored to servers may need to be checked for unexpected scripts.","fix":"Restore from your own off-Beget backups. Re-check CDN and IP/DNS settings, and rotate any credentials and secrets stored on Beget servers as a precaution. Keep backups with an independent provider.","status":"open","published_at":null,"first_seen_at":"2026-11-09T18:30:40+00:00","triaged_at":"2026-11-09T18:30:40+00:00","updated_at":"2026-11-09T18:31:56+00:00","category":"infrastructure","confidence":null,"triage":{"cause":{"at":"2026-11-09T18:33:17Z","path":"third-party-breach","entry":"unknown","reason":"The record says the attacker got into Beget's management systems but does not say how, while Beget's VPS, S3, Kubernetes and backup data was wiped, so customers' data went with a breached provider.","confidence":0.85}},"analyst_status":"done","analyst_note":null,"search":"'-202611':26A '000':68B,134B '1':37B,133B '200':67B '2026':39B '40':125B '6':111B '60':120B '9':165B 'aim':154B 'attack':12A,41B,152B,158B 'backup':96B,102B 'beget':6A,28A,48B,59B,76B,142B 'binari':95B 'bleepingcomput':164B 'campaign':29B 'cannot':22A 'cdn':89B 'chang':150B 'check':138B 'claim':161B 'cloud':4A,63B,82B 'cmp':25A 'complet':98B 'configur':93B 'custom':20A,69B 'cut':70B 'd3g4vi':27A 'data':10A,17A,21A,58B,79B,147B 'data-wip':9A 'dedic':127B 'destruct':157B 'domain':65B 'earli':31B 'early-warn':30B 'eras':56B 'file':101B 'found':143B 'got':42B 'half':107B 'hidden':140B 'hit':7A 'host':2A,62B,123B 'infrastructur':51B,83B 'ip':92B 'kubernet':16A,88B 'later':118B 'look':153B 'lost':85B,99B 'malwar':54B 'manag':45B 'manual':137B 'need':136B 'network':75B 'night':35B 'nov':38B,112B,166B 'part':103B 'provid':5A 'ran':53B 'recov':24A 'registrar':66B 'respons':163B 'restor':131B 'rough':106B 'russian':1A,60B 's3':14A,87B 'say':77B 'script':141B 'server':57B,72B,128B,135B 'set':90B 'share':122B 'sign':145B 'surviv':104B 'system':46B 'theft':148B 'unknown':159B 'updat':113B 'user':110B 'vps':13A,86B,94B,109B 'warn':32B 'web':61B 'week':117B 'whole':50B 'wipe':18A 'wiper':11A","nicknames":["Beget wiper attack"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["beget","begetwiperattack"],"ptokens":["beget"],"labels":["campaign","earlywarning","high","infrastructure"],"campaign_type":"malware","search_a":"'-202611':26A 'attack':12A 'beget':6A,28A 'cannot':22A 'cloud':4A 'cmp':25A 'custom':20A 'd3g4vi':27A 'data':10A,17A,21A 'data-wip':9A 'hit':7A 'host':2A 'kubernet':16A 'provid':5A 'recov':24A 'russian':1A 's3':14A 'vps':13A 'wipe':18A 'wiper':11A","search_b":"'000':68B,134B '1':37B,133B '200':67B '2026':39B '40':125B '6':111B '60':120B '9':165B 'aim':154B 'attack':41B,152B,158B 'backup':96B,102B 'beget':48B,59B,76B,142B 'binari':95B 'bleepingcomput':164B 'campaign':29B 'cdn':89B 'chang':150B 'check':138B 'claim':161B 'cloud':63B,82B 'complet':98B 'configur':93B 'custom':69B 'cut':70B 'data':58B,79B,147B 'dedic':127B 'destruct':157B 'domain':65B 'earli':31B 'early-warn':30B 'eras':56B 'file':101B 'found':143B 'got':42B 'half':107B 'hidden':140B 'host':62B,123B 'infrastructur':51B,83B 'ip':92B 'kubernet':88B 'later':118B 'look':153B 'lost':85B,99B 'malwar':54B 'manag':45B 'manual':137B 'need':136B 'network':75B 'night':35B 'nov':38B,112B,166B 'part':103B 'ran':53B 'registrar':66B 'respons':163B 'restor':131B 'rough':106B 'russian':60B 's3':87B 'say':77B 'script':141B 'server':57B,72B,128B,135B 'set':90B 'share':122B 'sign':145B 'surviv':104B 'system':46B 'theft':148B 'unknown':159B 'updat':113B 'user':110B 'vps':86B,94B,109B 'warn':32B 'web':61B 'week':117B 'whole':50B","search_c":"","cause_entry":"unknown","cause_path":"third-party-breach","disclosures_checked_at":null,"first_public_at":"2026-11-09T17:50:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-d3g4vi","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-09T18:30:40+00:00","fetched_at":"2026-11-09T18:30:40+00:00","note":null}],"documents":[{"id":108647,"url":"https://x.com/BleepinComputer/status/2119850216857727000","title":"@BleepinComputer: Russian cloud firm Beget rebuilds from scratch after data wiper attack\nhttps://t","kind":"post","source":"x","publisher":null,"text":"Russian cloud firm Beget rebuilds from scratch after data wiper attack\nhttps://t.co/tq5vavReYA\n\nhttps://t.co/tq5vavReYA\n\nlikes 4 reposts 3","published_at":"2026-11-09T17:50:51+00:00","relation":"describes","confidence":null,"note":null},{"id":108668,"url":"https://www.bleepingcomputer.com/news/security/russian-cloud-firm-beget-rebuilds-from-scratch-after-data-wiper-attack/","title":"BleepingComputer: Russian cloud firm Beget rebuilds from scratch after data wiper attack","kind":"blog","source":"blog","publisher":null,"text":"Russian cloud firm Beget rebuilds from scratch after data wiper attack\n\nA data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said. [...]","published_at":"2026-11-09T17:50:32+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}