According to the developer, the attackers used AI-assisted malware and tailored their tactics to the victims’ infrastructure

ISPsystem, part of Astra Group, has fixed a zero-day vulnerability in the VMmanager 6 Hosting virtualization platform that was exploited by attackers in a strike on the hosting provider FirstVDS. To protect its products, the developer released emergency updates and, together with Kaspersky Lab experts, audited the affected infrastructures.

The vulnerability made it possible to attack systems used for the automated deployment of virtual machines. According to ISPsystem, the attackers utilized malware created with artificial intelligence and tailored their tactics to the infrastructure of specific providers.

During the incident response, the company temporarily restricted remote management and the execution of internal scripts. The effectiveness of the fixes was verified on testbenches simulating hosting provider infrastructure. A single installation received more than 10,000 requests attempting to exploit various attack vectors. The secured testbenches could not be breached.

Security updates were also released for DCImanager, BILLmanager, and DNSmanager. ISPsystem has overhauled its vulnerability management processes and plans to implement automated AI-assisted penetration testing to detect threats.

The joint investigation with FirstVDS and Kaspersky Lab continues. Specialists are inspecting infrastructures for malicious files and previously established backdoors.