According to Astra Group data for 2025, VMmanager was used on more than 6,000 corporate and government servers.
Hackers have breached the VMmanager 6 virtual server management system, developed by ISPsystem from Astra Group. The attacks affected several Russian hosting providers, including FirstVDS. Attackers could have gained access to sensitive client data, including passwords, access keys, and cryptocurrency wallet information.
According to FirstVDS, the attackers exploited a platform vulnerability to launch malware on some virtualization nodes. It connected to client server disks in read mode, copied information, and transmitted it to a third-party server. At the same time, the operation of virtual machines was not disrupted, and detecting malicious activity with standard monitoring tools was difficult.
In addition to passwords and cryptocurrency wallet data, the program could steal SSH and API keys, cloud service tokens, command history, and user files. FirstVDS restricted external access to the management system and blocked the attackers' server address. Clients whose servers might have been affected were sent notifications.
The first reports of attacks appeared in mid-October. The VMmanager developer released three security updates but did not publicly disclose details about the vulnerabilities fixed. The investigation is ongoing, and the full extent of the leak is not yet known.
The platform is used by hosting and cloud companies, medical institutions, universities, and other organizations. The developer's website lists about 30 system users, including PSB Hosting, 4VPS, and Oblako.Ru. According to Astra Group data for 2025, VMmanager was used on more than 6,000 corporate and government servers.
