---
id: "CMP-202611-isynih"
page: "https://infrastack.ai/live/CMP-202611-isynih"
kind: "campaign"
aliases: []
title: "Russian cloud/VPS provider ESTT hit by ransomware on 8 Nov 2026: virtualization clusters and cloud management encrypted, customer VPS down (third Russian host after FirstVDS and Beget)"
severity: "medium"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "ESTT", "fixed": [], "vendor": "ESTT", "ecosystem": "saas"}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-09T22:28:30+00:00"
updated_at: "2026-11-09T22:28:48+00:00"
sources: [{"source": "analyst", "url": "https://t.me/dcestt/276", "first_seen_at": "2026-11-09T22:28:30+00:00", "cites": ["https://t.me/dcestt/276"]}]
exploit_sources: []
---

# Russian cloud/VPS provider ESTT hit by ransomware on 8 Nov 2026: virtualization clusters and cloud management encrypted, customer VPS down (third Russian host after FirstVDS and Beget)

Link for people: https://infrastack.ai/live/CMP-202611-isynih (this .md is for agents)

ESTT, a Russian cloud and VPS provider, says an outage on 8 Nov 2026 was caused, by preliminary data, by a ransomware attack that hit its virtualization clusters and cloud infrastructure management systems and disrupted customer services. Customers' dedicated physical servers were not affected. ESTT says it has found no signs of customer data leakage so far. As of 9 Nov about 90% of customer virtual servers were restored; the customer portal was still unavailable and there is no date for full recovery. How the attackers got in and who they are is unknown. It is the third Russian hosting provider hit in about a week, after FirstVDS and Beget (CMP-202611-d3g4vi); no link between the attacks has been shown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- saas:ESTT affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). The record says the attackers' entry point is unknown, while the ransomware hit ESTT's virtualization clusters and management systems, disrupting its customers' VPS even though no customer data leakage has been found so far.

How it reached others: customers' data or keys went with it (third-party-breach).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/causes.md#third-party-breach

## How to check

Do you run VPS or cloud servers at ESTT (support portal estyle.okdesk.ru)? Check whether your virtual servers came back and whether their data is intact. Dedicated physical servers at ESTT are said not to be affected. Indicators: unknown.

## Fix

Check restored VMs for missing data and unexpected changes, restore from your own off-ESTT backups where needed, and rotate credentials and secrets stored on ESTT VMs as a precaution. Contact ESTT support (+7 499 712-00-00, Telegram @OkdeskEstt_bot) with your VM ID. Keep backups with an independent provider.

## Timeline

- 2026-11-09T22:28:30+00:00 analyst https://t.me/dcestt/276

## Documents

- [describes] @campuscodi.risky.biz: After FirstVDS and Beget, another Russian cloud/VPS provider got hacked and serv https://bsky.app/profile/campuscodi.risky.biz/post/3mzvvx3jiac23
- [describes] ESTT (Telegram, official): causes of the 8 November outage https://t.me/dcestt/276

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_