[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fv3hlaFvmdgSJykjQOVmGtrYTZtKVojbF3tgFdi03Tfs":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":24,"category":25,"article_tags":29},"816a73e0-01f8-4447-972d-2c8bfc96b85c","Ransomware attack on Belarusian cloud firm disrupts businesses for days","ransomware-attack-on-belarusian-cloud-firm-disrupts-businesses-for-days-9b8698","ActiveCloud said hackers had breached its systems and encrypted parts of its cloud infrastructure, leaving customers unable to access key services for several days.","Belarusian cloud services provider ActiveCloud experienced a ransomware attack that encrypted parts of its cloud infrastructure, disrupting services for several days. While main services have been restored, some individual customer issues persist. The company stated there is no evidence of customer data theft and has not identified the attackers or their entry method. This incident follows similar attacks on hosting providers in neighboring Russia.","Belarusian cloud provider ActiveCloud hit by ransomware, disrupting services for days.","https:\u002F\u002Ftherecord.media\u002Fbelarus-cloud-provider-activecloud-ransomware-attack","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002Fserver_getty_images_unsplash_bba164f23e.jpg","2026-11-13T14:28:00+00:00","2026-11-13T15:00:05.344259+00:00",7,[17,20,22],{"name":18,"type":19},"ActiveCloud","vendor",{"name":21,"type":19},"ESTT",{"name":23,"type":19},"Beget","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":24,"icon":26,"name":27,"slug":28},null,"Ransomware","ransomware",[30,35,40,42],{"category":31},{"id":32,"icon":26,"name":33,"slug":34},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":36},{"id":37,"icon":26,"name":38,"slug":39},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":41},{"id":24,"icon":26,"name":27,"slug":28},{"category":43},{"id":44,"icon":26,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18,21,23],{"controls":50,"vendors":138},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":81,"name":82,"problem":83,"products":84},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"cohesity","Cohesity","\u002Fvendor-logos\u002Fcohesity.png","dataprotect","Cohesity DataProtect","https:\u002F\u002Fwww.cohesity.com\u002Fplatform\u002Fdataprotect\u002F","Backup and recovery with immutable snapshots, on premises or as a service.",{"slug":110,"name":111,"problem":112,"products":113},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":149},"ransomware-encrypts-cloud-providers-infrastructure-disrupting-customers-for-days","Ransomware Encrypts Cloud Provider's Infrastructure, Disrupting Customers for Days","A ransomware attack on Belarusian cloud provider ActiveCloud encrypted portions of its shared infrastructure, cascading disruption across multiple business customers simultaneously — illustrating the amplified blast radius when a hosting provider is compromised. The company could not identify the attackers or their initial access vector, suggesting insufficient logging and monitoring to support post-incident forensics. Recovery took several days and some customer issues persisted even after main services were restored, pointing to gaps in tested backup and recovery procedures. When a cloud provider is the victim, every tenant becomes an indirect victim, making provider-level resilience a critical concern for any business that outsources infrastructure.",[144,145,146,147,148],"NIST CSF 2.0 RC.RP: Incident Recovery Plan Execution","NIST SP 800-53 CP-9: System Backup","CIS Control 11: Data Recovery (v8)","NIS2 Article 21(2)(c)","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":150,"NIS2 Article 21(2)(c)":151,"CIS Control 11: Data Recovery (v8)":152,"NIST SP 800-53 CP-9: System Backup":153,"NIST CSF 2.0 RC.RP: Incident Recovery Plan Execution":154},"This point requires effective incident handling procedures, including detection and response; the provider's inability to identify the entry vector indicates logging and forensic capabilities were inadequate to support proper incident handling.","This point requires business continuity and crisis management measures, including backup and disaster recovery; the days-long disruption across customer businesses reflects insufficient continuity planning at the provider level.","CIS Control 11 mandates tested, offline or immutable backups; the extended recovery time strongly suggests backup integrity or recovery procedures were not regularly validated.","CP-9 requires organisations to protect backup information from ransomware-style destruction; encrypted infrastructure suggests backups were either absent, insufficient, or not isolated from the attack surface.","This category requires that recovery plans are executed and refined after incidents; the multi-day outage and lingering customer issues indicate recovery planning and execution were inadequate."]