[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fkzGW-9tMI1J7oKM7e2vQ2OK7TZ9bS5POorB0uQD-e6s":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"a5c2f7bc-2bba-4aa1-926c-c5ee58a8f1df","Russian cloud firm Beget rebuilds from scratch after data wiper attack","russian-cloud-firm-beget-rebuilds-from-scratch-after-data-wiper-attack-3b3799","A data-wiping malware attack has forced Russian cloud services provider Beget to rebuild its cloud infrastructure from scratch, the company said. [...]","Russian cloud services provider Beget suffered a destructive malware attack on November 1st that compromised its management systems and erased server data across its infrastructure. The attacker gained access to the management layer and deployed data-zeroing scripts, destroying all VPS, S3, and Kubernetes data, CDN settings, and IP configurations for over 200,000 customers. As of November 6, Beget had recovered 60% of shared hosting and 40% of dedicated servers, but acknowledged that full recovery is impossible for many users and requires rebuilding approximately 1,000 servers from scratch.","Russian cloud provider Beget rebuilds infrastructure after data-wiping malware attack destroys customer data.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Frussian-cloud-firm-beget-rebuilds-from-scratch-after-data-wiper-attack\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F11\u002F09\u002Fbeget.jpg","2026-11-09T17:50:32+00:00","2026-11-09T18:00:24.450847+00:00",8,[17,20,23,25],{"name":18,"type":19},"Beget","vendor",{"name":21,"type":22},"VPS","technology",{"name":24,"type":22},"Kubernetes",{"name":26,"type":22},"S3","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":27,"icon":29,"name":30,"slug":31},null,"Breaches","breaches",[33,38,43],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":39},{"id":40,"icon":29,"name":41,"slug":42},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":44},{"id":45,"icon":29,"name":46,"slug":47},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[18],{"controls":51,"vendors":138},[52,81,110],{"slug":53,"name":54,"problem":55,"products":56},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"slug":82,"name":83,"problem":84,"products":85},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"slug":111,"name":112,"problem":113,"products":114},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[115,122,130],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":42,"product_name":119,"url":120,"description":121},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":151},"beget-cloud-wiped-management-layer-compromise-destroys-200000-customers-data","Beget Cloud Wiped: Management Layer Compromise Destroys 200,000 Customers' Data","An attacker who gained access to Beget's cloud management layer deployed data-zeroing scripts that systematically destroyed VPS, S3, Kubernetes, and CDN data across the entire infrastructure, affecting over 200,000 customers. The root failure was a combination of insufficient access controls protecting the management plane and the absence of resilient, isolated backups that could have enabled full recovery. When a single management layer can reach and destroy all customer data simultaneously, the blast radius of any compromise becomes catastrophic. This incident illustrates that cloud providers—and their customers—must treat backup isolation and management-plane access control as existential priorities, not afterthoughts. The inability to fully recover data for many customers underscores that destruction-focused attacks demand a fundamentally different recovery posture than traditional ransomware scenarios.",[144,145,146,147,148,149,150],"CIS Control 11: Data Recovery","CIS Control 6: Access Control Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","MITRE ATT&CK T1485: Data Destruction",{"NIS2 Article 21(2)(b)":152,"CIS Control 11: Data Recovery":153,"MITRE ATT&CK T1485: Data Destruction":154,"NIST SP 800-53 SI-2: Flaw Remediation":155,"CIS Control 6: Access Control Management":156,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":157,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":158},"NIS2 explicitly requires essential and important entities to implement incident handling and business continuity measures, including backup management; Beget's inability to fully restore customer data reflects gaps in the continuity requirements this article mandates.","This control mandates automated, tested, and isolated data backups; had Beget maintained immutable offsite backups unreachable from the management plane, full data recovery would have been possible rather than rebuilding 1,000 servers from scratch.","This technique describes adversaries deploying scripts or tools to overwrite or zero-out data to render it unrecoverable, precisely what was executed against Beget's storage infrastructure; detective controls and anomaly detection on bulk write operations are the recommended mitigations.","Timely identification and remediation of vulnerabilities in the management layer could have closed the initial entry vector before the attacker leveraged it to deploy destructive scripts.","Restricting privileged access to management systems through least-privilege principles and MFA would have made it significantly harder for the attacker to gain the management-layer foothold needed to execute the wiper at scale.","A structured vulnerability management program covering the management infrastructure would have reduced the attack surface available to the threat actor who compromised Beget's control systems.","Strong identity controls over the cloud management plane—including MFA and just-in-time privileged access—would have limited the attacker's ability to authenticate and execute bulk data destruction across all customer environments."]