# FirstVDS Hosting Provider Breach via VMmanager 6 Vulnerability — Customer Virtual Disks Read and Secrets Stolen

> Attackers exploited an unpatched, CVE-less vulnerability in ISPsystem's VMmanager 6 to gain access to part of Russian hosting provider FirstVDS's virtualization infrastructure on 2026-10-17. A data-stealing program on the hypervisor hosts attached customer virtual disks read-only, searched them for credentials, keys and wallets, and sent the results to an attacker-controlled server, leaving no traces inside the guest VMs.

- **Published:** 2026-10-19T12:17:45Z
- **Last reviewed:** 2026-10-19T12:17:45Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3880
- **ID:** TL-2026-3880
- **Severity:** HIGH
- **Category:** DATA_BREACH
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 6 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-10-17 attackers used a vulnerability in VMmanager 6, the virtualization management platform from Russian vendor ISPsystem, to reach part of the infrastructure of Russian hosting provider FirstVDS. Per the FirstVDS notice relayed by Runet and SecurityLab, the unauthorized access window ran from 12:27 to 22:34 Moscow time on 2026-10-17 (about 10 hours). The initial exploitation method has not been disclosed. One report (Runet) says a recent software update introduced the flaw, but this is not corroborated elsewhere. No CVE has been assigned and the affected and fixed version numbers are not public.

The attackers placed a data-stealing program on some of the provider's infrastructure servers (hypervisor nodes). Because it ran at the virtualization host layer, outside the guest operating systems, it attached customer virtual disks in read-only mode, searched their contents and transmitted the findings to an attacker-controlled server. It did not modify the disks and left no traces in the guest systems or their OS logs, and the affected servers kept running normally. Reported data categories include passwords, SSH and API keys, cloud credentials and tokens (AWS, Azure, Google Cloud, OpenStack), repository tokens (GitHub, GitLab, npm), AI API keys (OpenAI, Anthropic), configuration files (.env, Docker, database connection strings), command histories, browser credentials and cookies, PGP and KeePass material, backup encryption keys, cryptocurrency wallet files and seed phrases, and other user files. SecurityLab's more detailed list is the broadest of these. The Record names only passwords, cloud credentials, configuration files and wallets.

FirstVDS says only part of its infrastructure was affected. It disabled external access to the virtualization management system and blocked the attacker's server address on its network (the address was not published). The first vendor patch removed the attacker's persistence mechanisms and closed the initial vector, according to the ISPsystem-relayed advisory. FirstVDS stated that the vulnerability remained not fully fixed, and ISPsystem released an additional patch on 2026-10-19 at 07:20 MSK. ISPsystem advised against restoring management-interface access until further updates and suggested whitelist-based access restriction as an interim measure. Additional compromised nodes were identified at 15:25 MSK on 2026-10-18. The number of affected customers and servers is undisclosed, and the attacker is unknown.

Because the theft occurred below the guest OS, customers cannot detect it from inside their VMs. Defenders should treat every secret stored on affected virtual servers as exposed, revoke rather than merely rotate credentials at the issuing services, move cryptocurrency to new wallets on clean devices, and review cloud, repository and exchange activity since 2026-10-17. They should also audit authorized_keys, local users, cron jobs and systemd services for persistence. Operators of VMmanager 6 should apply every available vendor update, keep the management interface off the public internet and restrict it by allowlist.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1005 Data from Local System
- T1552 Unsecured Credentials
- T1552.001 Credentials In Files
- T1552.003 Shell History
- T1552.004 Private Keys
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie

## Sources

- [Hackers steal customer data from major Russian hosting provider FirstVDS (The Record)](https://therecord.media/russia-cyberattack-firstvds-cloud)
- [FirstVDS Breach: Virtual Disks and Stored Secrets Copied (GridinSoft)](https://blog.gridinsoft.com/firstvds-breach-virtual-disk-secret-theft/)
- [FirstVDS: злоумышленники получили доступ к части инфраструктуры через уязвимость в системе управления VMmanager (Habr)](https://habr.com/ru/news/1095824/)
- [Хакеры добрались до серверов FirstVDS. Под угрозой криптокошельки и облачные аккаунты (SecurityLab)](https://www.securitylab.ru/news/578930.php)
- [Хакеры получили доступ к серверам клиентов FirstVDS через уязвимость в VMmanager (Runet)](https://runet.news/articles/84387)
- [Важно: Обновление безопасности VMmanager 6 (Hosting Kitchen / ISPsystem)](https://hosting.kitchen/ispsystem/vazhno-obnovlenie-bezopasnosti-vmmanager-6.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3880