Ransomware Attack on ActiveCloud Disrupts Key Cloud Services

Belarusian cloud services provider ActiveCloud suffered a ransomware attack earlier this week after hackers breached its systems and encrypted parts of its cloud infrastructure. The incident disrupted corporate websites, virtual servers, customer support channels, and products including E-Cloud, E-Cloud Protected, and SmartMail for businesses across Belarus, including news outlet Smartpress. First disclosed on Tuesday, the outage lasted for days before ActiveCloud restored main services by Friday, though some customers may still face difficulty restoring virtual machines.

Key Facts

What Happened During the ActiveCloud Ransomware Attack?

Hackers breached ActiveCloud's systems and encrypted parts of its cloud infrastructure earlier this week, leaving customers unable to access corporate websites, email services, virtual servers, and support channels. ActiveCloud disclosed the attack on Tuesday and restored its main services by Friday, though individual customer issues persist.

ActiveCloud confirmed that the disruption affected its core cloud hosting platform E-Cloud, its E-Cloud Protected security service, and its SmartMail corporate email platform. By Wednesday, the company had restored key parts of its infrastructure while cautioning that bringing all customer systems back online would take longer than initially expected. News outlet Smartpress confirmed its website was hosted on ActiveCloud and continued publishing despite the disruption, while local media reported temporary website and mobile app outages at Domino's Pizza in Belarus linked to technical problems.

"These have been difficult days," ActiveCloud said. "Our team has been working at full capacity, and today we can say that the most challenging phase is behind us."

ActiveCloud, quoted in The Record from Recorded Future News

ActiveCloud warned that while most services are operational again, some customers may still face difficulty restoring their virtual machines.

Was Customer Data Stolen and Who Is Responsible?

ActiveCloud reported that its investigation found no evidence that customer data was stolen during the ransomware attack. However, the company has not identified the hackers behind the intrusion or explained how they gained entry to its systems, leaving attribution and initial access methods unconfirmed.

ActiveCloud provides cloud hosting, virtual servers, corporate email, and IT infrastructure to businesses and organisations in Belarus and Russia. For Malaysian organisations using third-party hosting or cloud providers, multi-day provider disruptions underline the importance of maintaining independent recovery plans and off-provider backups.

ActiveCloud has found no evidence that customer data was stolen and has not identified how attackers breached its systems.

How Does This Relate to Recent Russian Hosting Attacks?

The ActiveCloud attack followed two cyberattacks on Russian hosting providers earlier this month: a November 8 ransomware incident at ESTT and an earlier destructive wiper attack against Beget. Despite the close timing across neighbouring countries, there is no publicly confirmed evidence linking any of the three incidents.

At ESTT, hackers targeted cloud management systems and disrupted customer websites, virtual servers, and other online services, though the company likewise reported no evidence of customer data theft. Days earlier, attackers accessed Beget's infrastructure management systems and deployed scripts that wiped data across parts of its cloud environment, disrupting websites and services for businesses, news organisations, and government agencies and destroying some virtual server backups.

There is no publicly confirmed evidence connecting the attacks on ActiveCloud, ESTT, and Beget.

What Should You Do?

• Note that no software patch, technical fix, or official vulnerability advisory is available in the source report, as the incident involves an infrastructure-level ransomware attack against a hosting provider.
• Affected ActiveCloud customers experiencing ongoing problems should work with the provider to verify the status of virtual machine restorations.
• Organisations relying on third-party cloud hosting should verify that virtual server backups are stored separately from their hosting provider's management environment, noting that Beget lost some virtual server backups during its recent attack.
• Malaysian organisations or users experiencing cyber incidents can report them to Cyber999 (MyCERT) for assistance.

Common Questions

Which ActiveCloud services were disrupted by the attack?

ActiveCloud reported disruptions across several products, including its main cloud hosting platform E-Cloud, its enhanced security offering E-Cloud Protected, and its corporate email service SmartMail. Virtual servers, corporate websites, and customer support channels were also affected, though ActiveCloud said most services were operational again by Friday.

Did the attackers steal customer data from ActiveCloud?

According to ActiveCloud, its investigation found no evidence that customer data was stolen during the ransomware attack. However, the company has not explained how hackers breached its systems or who is responsible, and some customers may still face difficulty restoring virtual machines.

Are the attacks on ActiveCloud, ESTT, and Beget connected?

While all three hosting providers in Belarus and Russia suffered cyberattacks in recent weeks, there is no publicly confirmed evidence linking them. None of the affected companies, ActiveCloud, ESTT, or Beget, has identified those responsible for the incidents.

Sources and Methodology

This dispatch is based solely on the report published by The Record from Recorded Future News (no publication date is included in the provided source text).