Destructive wiper attack on Russian host Beget destroys cloud VPS and disk backups

Key facts

Management plane intrusion and systematic data erasure

Major Russian web hosting provider and domain registrar Beget suffered a catastrophic, destructive cyberattack that wiped customer data across its cloud infrastructure and paralyzed hundreds of thousands of websites. The intrusion began overnight on 2 November 2026, prompting days of emergency containment as engineers scrambled to prevent cascading filesystem destruction.

According to official company disclosures, threat actors successfully penetrated the administrative control plane used to manage core hosting clusters. Having established privileged access, the attackers deployed automated wiper scripts designed to erase storage pools across active hypervisors.

The wiper caused extensive damage across Beget cloud services, erasing virtual private servers, cloud storage allocations, and containerized Kubernetes clusters. Most severely, the company acknowledged that all binary disk-image backups of its virtual machines were destroyed, forcing reliance on slower, manual recovery methods.

Zoom

The architectural failure of co-located backup storage

The destruction of virtual machine backups at Beget underscores a foundational vulnerability in enterprise cloud architecture: the co-location of backup storage networks with primary infrastructure management planes.

Comparison of backup architecture tiers and attack resilience during the Beget wiper incident

Backup Tier	Storage Fabric	Wiper Attack Outcome	Recovery Path
Binary Disk Images	Hypervisor-level SAN/Ceph pools	100% Destroyed by admin wiper scripts	Zero recovery; images permanently deleted
File-Level Backups	Segmented secondary storage arrays	Partially Intact across shared hosting	Slow, manual extraction of web assets
Bare-Metal Chassis	Physical server racks in data halls	Infected hypervisor operating systems	Manual inspection of >1,000 physical nodes

Because the administrative control plane shared root credentials with block-level backup repositories, the wiper script was able to issue storage volume deletion commands across both production hypervisors and backup storage pools simultaneously.

Consequently, automated snapshot restoration became impossible. Beget engineering leadership confirmed that more than 1,000 physical servers must be individually audited, disinfected, and re-imaged by technical staff before being reconnected to production networks.

Zoom

Commercial fallout and national infrastructure disruption

Founded in 2007, Beget represents a critical foundation of domestic Russian internet infrastructure. As of October 2026, the company ranked as the second-largest registrar of Russian .RU domains, managing approximately 540,700 domains, representing 14.7% of the total national market (derived).

The disruption cascaded across critical public and private online services throughout the country:

Municipal government portals were severed, including the official portal for the Naryan-Mar city administration. National regulatory tracking infrastructure also experienced outages, including Russia Chestny Znak product labeling and serialization system.

Scientific institutions reported significant downtime, including the Laboratory of Solar Astronomy at the Russian Academy of Sciences, which announced that its space weather monitoring website was offline due to domain registrar failures. Small and medium-sized commercial enterprises suffered extensive revenue losses as e-commerce storefronts remained dark.

Zoom

Legal liability shielding and geopolitical context

In response to mounting business interruption claims, Beget issued formal notices to clients declaring a force majeure event under Russian civil law, shielding the enterprise from contractual damages and service-level agreement penalties. The company also suspended customer billing for impacted hosting tiers.

The attack follows a series of escalating disruptions targeting Russian digital infrastructure, including an October breach at hosting provider FirstVDS that stole sensitive customer credentials and cryptocurrency wallets, as well as Ukrainian drone strikes that physically damaged Yandex, Sberbank, and VK data centers.

Additionally, Beget and its leadership were placed under European Union sanctions earlier in 2026 for providing digital infrastructure to Russian occupation administrations in Crimea, Donetsk, and Luhansk. Western technology sanctions continue to restrict access to enterprise server hardware and storage drives, significantly hindering hardware replacement and disaster recovery operations.

Not stated in official disclosures

The following technical and operational details remain undisclosed by Beget:

• The precise initial access vector (such as compromised administrative credentials, vulnerability in cluster management software, or supply chain compromise) that allowed attackers into the management plane.
• The exact number of customer virtual machines and databases whose data is permanently unrecoverable.
• The specific identity or organizational affiliation of the threat actors responsible for deploying the wiper scripts.
• The projected total financial loss incurred by Beget and its commercial customers as a result of the extended downtime.