ActiveCloud Ransomware Attack Disrupts Belarus Hosting
Belarusian cloud provider ActiveCloud says ransomware encrypted parts of its infrastructure. It reports no evidence of data theft. Two Russian hosts were hit this month.
Morgan "airgap" ReyesConfirmed: ransomware hit Belarusian cloud provider ActiveCloud this week. Customers lost access to hosting, email and support channels for days.
ActiveCloud first disclosed the attack on Tuesday, according to The Record. The company says attackers breached its systems and encrypted parts of its cloud infrastructure. By Wednesday it had restored key parts of the environment. On Friday it said main services were back, with problems still open for individual customers.
What was affected
- E-Cloud, the main cloud hosting platform.
- E-Cloud Protected, a service with added security protections.
- SmartMail, the corporate email service.
ActiveCloud serves businesses and organizations in Belarus and Russia. It warns some customers may still have trouble restoring virtual machines.
Downstream impact is confirmed in two cases. The news outlet Smartpress said its site was hosted on ActiveCloud and kept publishing. Local media reported temporary outages at the Belarus website and app of Domino’s Pizza, tied to technical problems. A direct link to ActiveCloud for the Domino’s outage is not established in the source.
What is not known
- Initial access: not disclosed.
- Attacker identity: not identified.
- Data theft: ActiveCloud says its investigation found no evidence of it. That is the company’s own finding, and the investigation is ongoing.
Pattern across regional hosts
The incident follows two attacks on hosting providers in Russia this month, per The Record:
- ESTT, November 8. Ransomware disrupted its cloud infrastructure. The company said attackers targeted cloud management systems and that it found no evidence of customer data theft.
- Beget, days earlier. A destructive attack. Attackers reached infrastructure management systems and ran scripts that wiped data in parts of the cloud environment. Some virtual server backups were lost.
There is no publicly confirmed evidence linking the three incidents, and none of the companies has named those responsible. Treat any shared-actor claim as unconfirmed.
Analysis: in two of the three cases, the reported target was the management layer of the hosting platform, which turns one intrusion into many customer outages. The sources do not say that is true of ActiveCloud.
Related coverage: Maersk Confirms Breach as WhiteArmor Demands $5M, Queens Public Library Confirms Ransomware Attack. More in the ransomware hub.
Found this useful? Share it.
