# Ransomware attack on Belarusian cloud provider ActiveCloud disrupts hosting, email and virtual servers

> ActiveCloud, a Belarusian cloud services provider serving businesses in Belarus and Russia, disclosed a cyberattack in which hackers breached its systems and encrypted parts of its cloud infrastructure. Customers lost access to cloud hosting, corporate email (SmartMail) and support channels for days; ActiveCloud reports no evidence of customer data theft.

- **Published:** 2026-11-13T14:59:34Z
- **Last reviewed:** 2026-11-13T14:59:34Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5969
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5969.png
- **ID:** TL-2026-5969
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 12 (3 shown free below)

## Description

On Tuesday 2026-11-10, ActiveCloud (operated by Active Technologies), a Belarusian cloud services provider whose customers are in Belarus and Russia, disclosed a large-scale cyberattack. Local Belarusian outlets (Onliner, dev.by) reported that its infrastructure had been under attack since about 03:30 that day and that the company initially called it a 'massive cyberattack'. The Record later reported that ActiveCloud said attackers breached its systems and encrypted parts of its cloud infrastructure, i.e. a ransomware-style incident.

Affected services were E-Cloud (the main cloud hosting platform), E-Cloud Protected (an additional security service), SmartMail (corporate email used in Belarus and Russia), customer corporate websites, virtual servers, and customer support channels (chat, telephony, ticketing). Downstream customer impact included the website of the Belarusian news outlet Smartpress (which kept publishing) and temporary outages of the Domino's Pizza Belarus website and mobile app, which the retailer attributed to 'technical problems'. By Wednesday 2026-11-11 key infrastructure had been restored; on Friday 2026-11-13 ActiveCloud said its main services were restored and it was still resolving issues for individual customers, some of whom may have trouble restoring virtual machines. ActiveCloud said: 'the most challenging phase is behind us.'

What is NOT known: the ransomware family, the threat actor, the initial access vector, any ransom demand, and any IOCs have not been published, and ActiveCloud has not explained how access was gained. No CVE has been linked. Its investigation reportedly found no evidence that customer data was stolen. The attribution fields below are therefore Unknown, and the initial-access technique (T1078) is an analyst assessment of a common cloud-provider entry route, not a sourced finding.

Context: two Russian hosting providers were hit in the same period. ESTT (e-Style Telecom) reported a ransomware attack on its cloud management systems on 2026-11-08, with customers losing websites and virtual servers; ESTT also reported no evidence of data theft. Beget reportedly had attackers access its infrastructure management systems and run scripts that wiped data from parts of its cloud, including some virtual server backups, forcing parts of the infrastructure to be rebuilt (Beget's incident is described as data-wiping, not ransomware). The Record states there is no publicly confirmed evidence linking the ActiveCloud, ESTT and Beget attacks, and none of the companies has identified those responsible. T1485 and T1651 are mapped from the related Beget incident and should be treated as contextual, not confirmed for ActiveCloud.

Defensive takeaways: cloud and hosting providers are high-leverage targets because compromise of management/orchestration planes impacts every tenant at once. Priorities are hardening and monitoring hypervisor and cloud-management consoles and admin credentials, enforcing MFA and network isolation for management planes, keeping offline/immutable backups of tenant VM images, and alerting on mass VM encryption, mass snapshot or backup deletion, and administrative command execution across many tenants.

## MITRE ATT&CK

- T1489 Service Stop
- T1485 Data Destruction
- T1651 Cloud Administration Command
- T1078 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5969 Bulk Cloud Administration Command Across Many Instances** (`TL-2026-5969-SPL-002`)

Detects one cloud identity issuing SSM SendCommand/StartSession (or Azure VM RunCommand) against 10+ instances in 10 minutes, consistent with attackers running PowerShell or shell scripts across tenant VMs via the management plane using stolen cloud credentials (T1651, T1059.001/.004, T1078.004), as reported in the Beget incident and recommended for monitoring after ActiveCloud.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1651, T1059.001, T1059.004, T1078.004
- **Data sources:** aws:cloudtrail, azure_activity
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=aws sourcetype="aws:cloudtrail" eventSource="ssm.amazonaws.com" (eventName=SendCommand OR eventName=StartSession) earliest=-24h
| rename "userIdentity.arn" as actor, "requestParameters.documentName" as doc
| eval targets=coalesce('requestParameters.instanceIds{}', 'requestParameters.target')
| bin _time span=10m
| stats count dc(targets) as target_count values(sourceIPAddress) as src_ips values(doc) as documents by _time, actor
| where target_count>=10
```

### Microsoft KQL

```kql
AzureActivity
| where TimeGenerated > ago(24h)
| where OperationNameValue =~ "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMAND/ACTION" or OperationNameValue =~ "MICROSOFT.COMPUTE/VIRTUALMACHINES/RUNCOMMANDS/WRITE"
| where ActivityStatusValue == "Success"
| summarize VMCount=dcount(_ResourceId), Operations=count(), SourceIPs=make_set(CallerIpAddress, 10) by Caller, bin(TimeGenerated, 10m)
| where VMCount >= 10
```

### Sigma

```yaml
title: TL-2026-5969 Cloud Administration Command Script Execution via SSM
id: 2d9b7e53-81c4-4a6f-b3e0-5a17c9d28f02
status: experimental
description: Detects AWS SSM SendCommand using shell, PowerShell or remote-script run documents, which can be abused to execute scripts on many tenant VMs from the management plane (Cloud Administration Command). Combine with the SPL/KQL fleet-size thresholds.
references:
    - https://therecord.media/belarus-cloud-provider-activecloud-ransomware-attack
    - https://t.me/actech_by_cloud/931
    - https://blog.gridinsoft.com/beget-cyberattack-wiped-cloud-vps-backups/
author: Threadlinqs Team
date: 2026-11-13
tags:
    - attack.execution
    - attack.t1651
    - attack.t1059.001
    - attack.t1059.004
    - attack.initial-access
    - attack.t1078.004
logsource:
    product: aws
    service: cloudtrail
detection:
    selection:
        eventSource: 'ssm.amazonaws.com'
        eventName: 'SendCommand'
        requestParameters.documentName:
            - 'AWS-RunShellScript'
            - 'AWS-RunPowerShellScript'
            - 'AWS-RunRemoteScript'
    condition: selection
falsepositives:
    - Patch management and configuration automation
    - Authorized administrators running fleet maintenance
level: medium

```

**Known false positives:**

- Patch management and fleet configuration automation
- Authorized incident-response or maintenance runs

**Tuning notes:** Allow-list automation roles and change windows; raise or lower the 10-instance threshold to fleet size; alert immediately when the actor is a human user from a new source IP.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5969 One Source Authenticating to Many Hosts Over SSH (Management Plane Fan-Out) (locked: unlock with TL Creds)
- TL-2026-5969 Recovery Inhibition, WMI Shadow Deletion and Event Log Clearing Before Encryption (locked: unlock with TL Creds)
- TL-2026-5969 Mass Stop or Disable of Backup, Database, Mail and Security Services (locked: unlock with TL Creds)
- TL-2026-5969 Hypervisor Mass VM Process Kill, Power-Off or Host Shutdown (ESXi Shell) (locked: unlock with TL Creds)
- TL-2026-5969 Linux Hypervisor Disk Wipe, Storage Destruction and VM Image Deletion (locked: unlock with TL Creds)
- TL-2026-5969 Ransomware Note Dropped Across Many Directories (Local and Over SMB) (locked: unlock with TL Creds)
- TL-2026-5969 ActiveCloud-Style Cloud Console Login Without MFA (Valid Accounts) (locked: unlock with TL Creds)
- TL-2026-5969 Mass Snapshot, Backup and Instance Deletion in Cloud Control Plane (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 12)

Defanged, TLP:CLEAR.

- URL: `hxxps://t[.]me/actech_by_cloud/931`
- URL: `hxxps://t[.]me/actech_by_cloud/946`
- URL: `hxxps://t[.]me/dcestt/276`

Full set of 12 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Ransomware attack on Belarusian cloud firm disrupts businesses for days](https://therecord.media/belarus-cloud-provider-activecloud-ransomware-attack)
- [ActiveCloud Telegram - initial disclosure](https://t.me/actech_by_cloud/931)
- [ActiveCloud Telegram - latest recovery update](https://t.me/actech_by_cloud/946)
- [У облачного провайдера ActiveCloud сбой - сообщают о «массированной кибератаке» (Onliner)](https://tech.onliner.by/amp/2026/11/10/activecloud-sboi)
- [Belarusian cloud provider ActiveCloud under massive cyberattack (dev.by)](https://devby.io/news/belarusskii-oblachnyi-provaider-activecloud-pod-massirovannoi-kiberatakoi)
- [Smartpress: our site was also affected by the ActiveCloud cyberattack](https://smartpress.by/news/nash-sayt-tozhe-postradal-ot-kiberataki-na-activecloud-chto-vazhno-znat-chitatelyam-smartpress-by/)
- [Domino's Belarus outage reports (Zerkalo)](https://news.zerkalo.io/amp/economics/140340.html)
- [ESTT Telegram statement on ransomware attack](https://t.me/dcestt/276)
- [ESTT services down: servers being restored (Anti-Malware.ru)](https://www.anti-malware.ru/news/2026-11-09-111332/51975)
- [Russian cloud firm Beget rebuilds from scratch after data wiper attack (BleepingComputer)](https://bleepingcomputer.com/news/security/russian-cloud-firm-beget-rebuilds-from-scratch-after-data-wiper-attack)
- [Beget Says Attackers Wiped Cloud Data After Management-Layer Breach (Gridinsoft)](https://blog.gridinsoft.com/beget-cyberattack-wiped-cloud-vps-backups/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5969