Threat reportData BreachTL-2026-3880
FirstVDS Hosting Provider Breach via VMmanager 6 Vulnerability — Customer Virtual Disks Read and Secrets Stolen
FirstVDS Hosting Provider Breach via VMmanager 6 (TL-2026-3880), also tracked as FirstVDS VMmanager 6 breach, is a high-severity data breach, first published 2026-10-19. It has no confirmed attribution, affects ISPsystem VMmanager 6, maps to 8 MITRE ATT&CK techniques (T1005, T1190, T1539), and is covered by 9 detection rules and 6 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 6Indicators of compromise
Key facts for TL-2026-3880
- Threat ID
- TL-2026-3880
- Also known as
- FirstVDS VMmanager 6 breach
- Severity
- HIGH
- Status
- ACTIVE
- Category
- DATA_BREACH
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- hosting, cloud-services, technology, cryptocurrency
- Target regions
- russia
- Detection rules
- 9
- Indicators of compromise
- 6
How FirstVDS Hosting Provider Breach via VMmanager 6 works
Attackers exploited an unpatched, CVE-less vulnerability in ISPsystem's VMmanager 6 to gain access to part of Russian hosting provider FirstVDS's virtualization infrastructure on 2026-10-17. A data-stealing program on the hypervisor hosts attached customer virtual disks read-only, searched them for credentials, keys and wallets, and sent the results to an attacker-controlled server, leaving no traces inside the guest VMs.
On 2026-10-17 attackers used a vulnerability in VMmanager 6, the virtualization management platform from Russian vendor ISPsystem, to reach part of the infrastructure of Russian hosting provider FirstVDS. Per the FirstVDS notice relayed by Runet and SecurityLab, the unauthorized access window ran from 12:27 to 22:34 Moscow time on 2026-10-17 (about 10 hours). The initial exploitation method has not been disclosed. One report (Runet) says a recent software update introduced the flaw, but this is not corroborated elsewhere. No CVE has been assigned and the affected and fixed version numbers are not public.
The attackers placed a data-stealing program on some of the provider's infrastructure servers (hypervisor nodes). Because it ran at the virtualization host layer, outside the guest operating systems, it attached customer virtual disks in read-only mode, searched their contents and transmitted the findings to an attacker-controlled server. It did not modify the disks and left no traces in the guest systems or their OS logs, and the affected servers kept running normally. Reported data categories include passwords, SSH and API keys, cloud credentials and tokens (AWS, Azure, Google Cloud, OpenStack), repository tokens (GitHub, GitLab, npm), AI API keys (OpenAI, Anthropic), configuration files (.env, Docker, database connection strings), command histories, browser credentials and cookies, PGP and KeePass material, backup encryption keys, cryptocurrency wallet files and seed phrases, and other user files. SecurityLab's more detailed list is the broadest of these. The Record names only passwords, cloud credentials, configuration files and wallets.
FirstVDS says only part of its infrastructure was affected. It disabled external access to the virtualization management system and blocked the attacker's server address on its network (the address was not published). The first vendor patch removed the attacker's persistence mechanisms and closed the initial vector, according to the ISPsystem-relayed advisory. FirstVDS stated that the vulnerability remained not fully fixed, and ISPsystem released an additional patch on 2026-10-19 at 07:20 MSK. ISPsystem advised against restoring management-interface access until further updates and suggested whitelist-based access restriction as an interim measure. Additional compromised nodes were identified at 15:25 MSK on 2026-10-18. The number of affected customers and servers is undisclosed, and the attacker is unknown.
Because the theft occurred below the guest OS, customers cannot detect it from inside their VMs. Defenders should treat every secret stored on affected virtual servers as exposed, revoke rather than merely rotate credentials at the issuing services, move cryptocurrency to new wallets on clean devices, and review cloud, repository and exchange activity since 2026-10-17. They should also audit authorized_keys, local users, cron jobs and systemd services for persistence. Operators of VMmanager 6 should apply every available vendor update, keep the management interface off the public internet and restrict it by allowlist.
MITRE ATT&CK techniques used in TL-2026-3880
Collection
Initial Access
T1190 Exploit Public-Facing Application
Credential Access
T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1552.001 Credentials In Files; T1552.003 Shell History; T1552.004 Private Keys; T1555.003 Credentials from Web Browsers
Affected products and versions in FirstVDS Hosting Provider Breach via VMmanager 6
- ISPsystem — VMmanager 6
Vulnerable versions: VMmanager 6 (specific versions not disclosed)
Fixed in: Interim patches released 2026-10-18/19; permanent fix pending - FirstVDS — FirstVDS hosting virtual servers (VPS) on affected nodes
Vulnerable versions: Customer VMs on affected infrastructure nodes
Remediation for FirstVDS Hosting Provider Breach via VMmanager 6
Patches
- ISPsystem VMmanager 6 security update (removes attacker persistence and closes the initial vector)
- ISPsystem additional interim patch released 2026-10-19 07:20 MSK; the vendor stated a permanent fix is still in development
Immediate actions
- Apply all available ISPsystem VMmanager 6 security updates, including the interim patch released 2026-10-19, and do not re-expose the management interface until further updates ship
- Restrict VMmanager management access to an allowlist and keep it off the public internet
- Treat all secrets stored on affected virtual servers as compromised: revoke (not just replace) SSH keys, passwords, API keys, cloud and repository tokens
- Move cryptocurrency from wallets on affected servers to new wallets created on clean devices
- Review cloud, repository, exchange and login activity since 2026-10-17
Workarounds
- Disable external access to the virtualization management system
- Block the attacker's exfiltration server address at the network level
- Audit ~/.ssh/authorized_keys, local users, cron jobs and systemd services for persistence
- Consult legal counsel on personal-data breach notification obligations (Roskomnadzor) where applicable
Longer-term hardening
- Segment and monitor hypervisor/management-plane hosts and alert on unexpected read-only attachment of guest disks
- Avoid storing long-lived secrets, wallet seeds and API keys on VPS disks; use a secrets manager or hardware-backed keys
- Encrypt guest disks and backups with keys that are not stored on the same host
Timeline of FirstVDS Hosting Provider Breach via VMmanager 6
- Data-stealing program on hypervisor hosts attaches customer virtual disks read-only, searches contents and sends credentials, keys, wallets and files to an attacker-controlled server.
- Attackers exploit a VMmanager 6 vulnerability to access part of FirstVDS infrastructure; unauthorized access window 12:27–22:34 MSK (about 10 hours).
- ISPsystem releases a VMmanager 6 security update that removes attacker persistence mechanisms and closes the initial access vector; it recommends allowlist-based access restriction.
- At 15:25 MSK FirstVDS identifies additional compromised nodes and sends further notifications to affected server owners.
- FirstVDS discloses the breach via its Telegram channel and status panel, disables external access to the virtualization management system and blocks the attacker's server address.
- The Record from Recorded Future News reports the breach; FirstVDS keeps operating with restrictions and customers are urged to change credentials.
- At 07:20 MSK ISPsystem releases an additional patch; FirstVDS states the vulnerability is still not fully fixed and permanent fixes are in development.
Sources cited for FirstVDS Hosting Provider Breach via VMmanager 6
- Hackers steal customer data from major Russian hosting provider FirstVDS (The Record)
- FirstVDS Breach: Virtual Disks and Stored Secrets Copied (GridinSoft)
- FirstVDS: злоумышленники получили доступ к части инфраструктуры через уязвимость в системе управления VMmanager (Habr)
- Хакеры добрались до серверов FirstVDS. Под угрозой криптокошельки и облачные аккаунты (SecurityLab)
- Хакеры получили доступ к серверам клиентов FirstVDS через уязвимость в VMmanager (Runet)
- Важно: Обновление безопасности VMmanager 6 (Hosting Kitchen / ISPsystem)
Detection coverage for TL-2026-3880
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3880 across Splunk SPL, Microsoft KQL and Sigma, covering 6 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.