{"id":"CMP-202611-isynih","kind":"campaign","aliases":[],"related":["CMP-202611-d3g4vi"],"title":"Russian cloud/VPS provider ESTT hit by ransomware on 8 Nov 2026: virtualization clusters and cloud management encrypted, customer VPS down (third Russian host after FirstVDS and Beget)","description":null,"summary":"ESTT, a Russian cloud and VPS provider, says an outage on 8 Nov 2026 was caused, by preliminary data, by a ransomware attack that hit its virtualization clusters and cloud infrastructure management systems and disrupted customer services. Customers' dedicated physical servers were not affected. ESTT says it has found no signs of customer data leakage so far. As of 9 Nov about 90% of customer virtual servers were restored; the customer portal was still unavailable and there is no date for full recovery. How the attackers got in and who they are is unknown. It is the third Russian hosting provider hit in about a week, after FirstVDS and Beget (CMP-202611-d3g4vi); no link between the attacks has been shown.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-09T22:28:30+00:00","products":[{"name":"ESTT","fixed":[],"vendor":"ESTT","ecosystem":"saas"}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"Do you run VPS or cloud servers at ESTT (support portal estyle.okdesk.ru)? Check whether your virtual servers came back and whether their data is intact. Dedicated physical servers at ESTT are said not to be affected. Indicators: unknown.","fix":"Check restored VMs for missing data and unexpected changes, restore from your own off-ESTT backups where needed, and rotate credentials and secrets stored on ESTT VMs as a precaution. Contact ESTT support (+7 499 712-00-00, Telegram @OkdeskEstt_bot) with your VM ID. Keep backups with an independent provider.","status":"open","published_at":null,"first_seen_at":"2026-11-09T22:28:30+00:00","triaged_at":"2026-11-09T22:28:30+00:00","updated_at":"2026-11-09T22:28:48+00:00","category":"infrastructure","confidence":null,"triage":{"cause":{"at":"2026-11-09T22:31:09Z","path":"third-party-breach","entry":"unknown","reason":"The record says the attackers' entry point is unknown, while the ransomware hit ESTT's virtualization clusters and management systems, disrupting its customers' VPS even though no customer data leakage has been found so far.","confidence":0.55}},"analyst_status":"done","analyst_note":null,"search":"'-202611':29A,147B '2026':11A,49B '8':9A,47B '9':95B '90':98B 'affect':79B 'attack':58B,121B,153B 'beget':27A,145B 'campaign':32B 'caus':51B 'cloud':15A,39B,65B 'cloud/vps':2A 'cluster':13A,63B 'cmp':28A,146B 'custom':18A,71B,73B,88B,100B,106B 'd3g4vi':148B 'data':54B,89B 'date':115B 'dedic':74B 'disrupt':70B 'earli':34B 'early-warn':33B 'encrypt':17A 'estt':4A,31A,36B,80B 'far':92B 'firstvd':25A,143B 'found':84B 'full':117B 'got':122B 'hit':5A,60B,137B 'host':23A,135B 'infrastructur':66B 'isynih':30A 'leakag':90B 'link':150B 'manag':16A,67B 'nov':10A,48B,96B 'outag':45B 'physic':75B 'portal':107B 'preliminari':53B 'provid':3A,42B,136B 'ransomwar':7A,57B 'recoveri':118B 'restor':104B 'russian':1A,22A,38B,134B 'say':43B,81B 'server':76B,102B 'servic':72B 'shown':156B 'sign':86B 'still':109B 'system':68B 'third':21A,133B 'unavail':110B 'unknown':129B 'virtual':12A,62B,101B 'vps':19A,41B 'warn':35B 'week':141B","nicknames":["ESTT ransomware attack"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["estt","esttransomwareattack"],"ptokens":["estt"],"labels":["campaign","earlywarning","infrastructure","medium"],"campaign_type":"malware","search_a":"'-202611':29A '2026':11A '8':9A 'beget':27A 'cloud':15A 'cloud/vps':2A 'cluster':13A 'cmp':28A 'custom':18A 'encrypt':17A 'estt':4A,31A 'firstvd':25A 'hit':5A 'host':23A 'isynih':30A 'manag':16A 'nov':10A 'provid':3A 'ransomwar':7A 'russian':1A,22A 'third':21A 'virtual':12A 'vps':19A","search_b":"'-202611':147B '2026':49B '8':47B '9':95B '90':98B 'affect':79B 'attack':58B,121B,153B 'beget':145B 'campaign':32B 'caus':51B 'cloud':39B,65B 'cluster':63B 'cmp':146B 'custom':71B,73B,88B,100B,106B 'd3g4vi':148B 'data':54B,89B 'date':115B 'dedic':74B 'disrupt':70B 'earli':34B 'early-warn':33B 'estt':36B,80B 'far':92B 'firstvd':143B 'found':84B 'full':117B 'got':122B 'hit':60B,137B 'host':135B 'infrastructur':66B 'leakag':90B 'link':150B 'manag':67B 'nov':48B,96B 'outag':45B 'physic':75B 'portal':107B 'preliminari':53B 'provid':42B,136B 'ransomwar':57B 'recoveri':118B 'restor':104B 'russian':38B,134B 'say':43B,81B 'server':76B,102B 'servic':72B 'shown':156B 'sign':86B 'still':109B 'system':68B 'third':133B 'unavail':110B 'unknown':129B 'virtual':62B,101B 'vps':41B 'warn':35B 'week':141B","search_c":"","cause_entry":"unknown","cause_path":"third-party-breach","disclosures_checked_at":null,"first_public_at":"2026-11-09T00:17:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-isynih","url":"https://t.me/dcestt/276","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-09T22:28:30+00:00","fetched_at":"2026-11-09T22:28:30+00:00","note":null,"cites":["https://t.me/dcestt/276"]}],"documents":[{"id":110165,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3mzvvx3jiac23","title":"@campuscodi.risky.biz: After FirstVDS and Beget, another Russian cloud/VPS provider got hacked and serv","kind":"post","source":"bluesky","publisher":null,"text":"After FirstVDS and Beget, another Russian cloud/VPS provider got hacked and servers destroyed\n\nThey recovered fast, in about 1-2 days\n\nt.me/dcestt/276?e...\nhttps://t.me/dcestt/276?embed=1&mode=tme\n\nlikes 0 reposts 1","published_at":"2026-11-09T21:52:23+00:00","relation":"describes","confidence":null,"note":null},{"id":110310,"url":"https://t.me/dcestt/276","title":"ESTT (Telegram, official): causes of the 8 November outage","kind":"vendor","source":"analyst","publisher":null,"text":"ESTT notice to customers (translated from Russian): Preliminary data shows the 8 November outage was caused by a cyberattack using ransomware (encryptor). Virtualization clusters and ESTT cloud infrastructure management systems were affected, disrupting customer services. Customers' dedicated physical servers were not affected. No signs of customer data leakage found so far. 90% of customer virtual servers restored, work on the rest continues. Customer portal (personal account) still unavailable. No timeline for full recovery. Support: +7 (499) 712-00-00, Telegram bot @OkdeskEstt_bot, https://estyle.okdesk.ru/.","published_at":"2026-11-09T00:17:00+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}