Skip to navigation

Threat reportRansomwareTL-2026-5969

Ransomware attack on Belarusian cloud provider ActiveCloud disrupts hosting, email and virtual servers

highACTIVE

ActiveCloud, a Belarusian cloud services provider serving businesses in Belarus and Russia, disclosed a cyberattack in which hackers breached its systems and encrypted parts of its cloud infrastructure. Customers lost access to cloud hosting, corporate email (SmartMail) and support channels for days; ActiveCloud reports no evidence of customer data theft.

Key facts

IdentifiersTL-2026-5969
SeverityHIGH
First disclosed
Affected productsActiveCloud (Active Technologies) E-Cloud cloud hosting platform, E-Cloud Protected, SmartMail corporate email, virtual servers, hosting and support channels
MITRE ATT&CK techniquesT1078 Valid Accounts, T1485 Data Destruction, T1489 Service Stop, T1651 Cloud Administration Command
MotivationUNKNOWN
Target sectorstechnology, cloud-hosting, news - media, retail
Target regionsbelarus, russia
Detection rules9 (1 shown free)
Sources11 cited sources

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5969 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5969 Bulk Cloud Administration Command Across Many Instances

Detects one cloud identity issuing SSM SendCommand/StartSession (or Azure VM RunCommand) against 10+ instances in 10 minutes, consistent with attackers running PowerShell or shell scripts across tenant VMs via the management plane using stolen cloud credentials (T1651, T1059.001/.004, T1078.004), as reported in the Beget incident and recommended for monitoring after ActiveCloud.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1651, T1059.001, T1059.004, T1078.004
  • Data sources: aws:cloudtrail, azure_activity
  • Severity: high
  • Confidence: medium

Splunk SPL

index=aws sourcetype="aws:cloudtrail" eventSource="ssm.amazonaws.com" (eventName=SendCommand OR eventName=StartSession) earliest=-24h
| rename "userIdentity.arn" as actor, "requestParameters.documentName" as doc
| eval targets=coalesce('requestParameters.instanceIds{}', 'requestParameters.target')
| bin _time span=10m
| stats count dc(targets) as target_count values(sourceIPAddress) as src_ips values(doc) as documents by _time, actor
| where target_count>=10

Microsoft KQL

AzureActivity
| where TimeGenerated > ago(24h)
| where OperationNameValue =~ "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION" or OperationNameValue =~ "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMANDS/WRITE"
| where ActivityStatusValue == "Success"
| summarize VMCount=dcount(_ResourceId), Operations=count(), SourceIPs=make_set(CallerIpAddress, 10) by Caller, bin(TimeGenerated, 10m)
| where VMCount >= 10

Sigma

title: TL-2026-5969 Cloud Administration Command Script Execution via SSM
id: 2d9b7e53-81c4-4a6f-b3e0-5a17c9d28f02
status: experimental
description: Detects AWS SSM SendCommand using shell, PowerShell or remote-script run documents, which can be abused to execute scripts on many tenant VMs from the management plane (Cloud Administration Command). Combine with the SPL/KQL fleet-size thresholds.
references:
    - https://therecord.media/belarus-cloud-provider-activecloud-ransomware-attack
    - https://t.me/actech_by_cloud/931
    - https://blog.gridinsoft.com/beget-cyberattack-wiped-cloud-vps-backups/
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.execution
    - attack.t1651
    - attack.t1059.001
    - attack.t1059.004
    - attack.initial-access
    - attack.t1078.004
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'ssm.amazonaws.com'
        eventName: 'SendCommand'
        requestParameters.documentName:
            - 'AWS-RunShellScript'
            - 'AWS-RunPowerShellScript'
            - 'AWS-RunRemoteScript'
    condition: selection
falsepositives:
    - Patch management and configuration automation
    - Authorized administrators running fleet maintenance
level: medium

Known false positives:

  • Patch management and fleet configuration automation
  • Authorized incident-response or maintenance runs

Tuning notes: Allow-list automation roles and change windows; raise or lower the 10-instance threshold to fleet size; alert immediately when the actor is a human user from a new source IP.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • TL-2026-5969 One Source Authenticating to Many Hosts Over SSH (Management Plane Fan-Out) · unlock with TL Creds
  • TL-2026-5969 Recovery Inhibition, WMI Shadow Deletion and Event Log Clearing Before Encryption · unlock with TL Creds
  • TL-2026-5969 Mass Stop or Disable of Backup, Database, Mail and Security Services · unlock with TL Creds
  • TL-2026-5969 Hypervisor Mass VM Process Kill, Power-Off or Host Shutdown (ESXi Shell) · unlock with TL Creds
  • TL-2026-5969 Linux Hypervisor Disk Wipe, Storage Destruction and VM Image Deletion · unlock with TL Creds
  • TL-2026-5969 Ransomware Note Dropped Across Many Directories (Local and Over SMB) · unlock with TL Creds
  • TL-2026-5969 ActiveCloud-Style Cloud Console Login Without MFA (Valid Accounts) · unlock with TL Creds
  • TL-2026-5969 Mass Snapshot, Backup and Instance Deletion in Cloud Control Plane · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5969.

Sample indicators (3 of 12)

  • URL: hxxps://t[.]me/actech_by_cloud/931
  • URL: hxxps://t[.]me/actech_by_cloud/946
  • URL: hxxps://t[.]me/dcestt/276

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

12 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

On Tuesday 2026-11-10, ActiveCloud (operated by Active Technologies), a Belarusian cloud services provider whose customers are in Belarus and Russia, disclosed a large-scale cyberattack. Local Belarusian outlets (Onliner, dev.by) reported that its infrastructure had been under attack since about 03:30 that day and that the company initially called it a 'massive cyberattack'. The Record later reported that ActiveCloud said attackers breached its systems and encrypted parts of its cloud infrastructure, i.e. a ransomware-style incident.

Affected services were E-Cloud (the main cloud hosting platform), E-Cloud Protected (an additional security service), SmartMail (corporate email used in Belarus and Russia), customer corporate websites, virtual servers, and customer support channels (chat, telephony, ticketing). Downstream customer impact included the website of the Belarusian news outlet Smartpress (which kept publishing) and temporary outages of the Domino's Pizza Belarus website and mobile app, which the retailer attributed to 'technical problems'. By Wednesday 2026-11-11 key infrastructure had been restored; on Friday 2026-11-13 ActiveCloud said its main services were restored and it was still resolving issues for individual customers, some of whom may have trouble restoring virtual machines. ActiveCloud said: 'the most challenging phase is behind us.'

What is NOT known: the ransomware family, the threat actor, the initial access vector, any ransom demand, and any IOCs have not been published, and ActiveCloud has not explained how access was gained. No CVE has been linked. Its investigation reportedly found no evidence that customer data was stolen. The attribution fields below are therefore Unknown, and the initial-access technique (T1078) is an analyst assessment of a common cloud-provider entry route, not a sourced finding.

Context: two Russian hosting providers were hit in the same period. ESTT (e-Style Telecom) reported a ransomware attack on its cloud management systems on 2026-11-08, with customers losing websites and virtual servers; ESTT also reported no evidence of data theft. Beget reportedly had attackers access its infrastructure management systems and run scripts that wiped data from parts of its cloud, including some virtual server backups, forcing parts of the infrastructure to be rebuilt (Beget's incident is described as data-wiping, not ransomware). The Record states there is no publicly confirmed evidence linking the ActiveCloud, ESTT and Beget attacks, and none of the companies has identified those responsible. T1485 and T1651 are mapped from the related Beget incident and should be treated as contextual, not confirmed for ActiveCloud.

Defensive takeaways: cloud and hosting providers are high-leverage targets because compromise of management/orchestration planes impacts every tenant at once. Priorities are hardening and monitoring hypervisor and cloud-management consoles and admin credentials, enforcing MFA and network isolation for management planes, keeping offline/immutable backups of tenant VM images, and alerting on mass VM encryption, mass snapshot or backup deletion, and administrative command execution across many tenants.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts

Impact

T1485 Data Destruction; T1489 Service Stop

Execution

T1651 Cloud Administration Command

Remediation

Immediate actions

  • ActiveCloud customers: verify integrity of restored virtual machines and re-validate credentials, API keys and SSH keys used on ActiveCloud-hosted systems
  • Rotate credentials for ActiveCloud portal, SmartMail and any services reachable from affected hosting
  • Monitor ActiveCloud's official status channel for updates on remaining customer-specific issues
  • Treat mail received via SmartMail during the outage window as potentially unreliable and review mail forwarding rules

Workarounds

  • Fail over critical websites and email to an alternate provider while the provider recovers
  • Restore from independent backups rather than provider-restored images where integrity is in doubt

Longer-term hardening

  • Keep offline or immutable backups of critical VMs and data outside the hosting provider's own control plane
  • Maintain provider-independent DNS, email failover and status communication for business continuity
  • Cloud/hosting providers: isolate and enforce MFA on management and orchestration planes; log and alert on privileged administrative actions
  • Alert on mass VM encryption, mass snapshot/backup deletion and bulk administrative command execution across tenants

Affected and fixed versions

  • ActiveCloud (Active Technologies) — E-Cloud cloud hosting platform, E-Cloud Protected, SmartMail corporate email, virtual servers, hosting and support channels
    Vulnerable versions: unspecified

Timeline

  • Related incident: Russian hosting provider Beget suffers a data-wiping attack after attackers access infrastructure management systems; some VPS backups lost (exact date reported variously as Nov 1-2)
  • Related incident: Russian hosting provider ESTT reports a ransomware attack on its cloud management systems; customers lose websites and virtual servers
  • ActiveCloud publicly discloses a massive cyberattack via its Telegram channel; downstream sites such as Smartpress and Domino's Belarus are affected
  • ActiveCloud infrastructure comes under attack from about 03:30; E-Cloud, E-Cloud Protected, SmartMail, hosting and support channels (chat, telephony, tickets) go down
  • Key ActiveCloud infrastructure restored; full recovery expected to take longer
  • The Record reports the incident as a ransomware attack that encrypted parts of the cloud infrastructure; ransomware family, actor and access vector remain undisclosed
  • ActiveCloud says main services are restored and it is resolving issues for individual customers; says investigation found no evidence of customer data theft

Sources cited

Previous and next in ransomware

Drafted by the Threadlinqs research pipeline from 11 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats