ActiveCloud says Cyber attack locked cloud infrastructure, disrupting Belarus customers

The Record reported that ActiveCloud said intruders breached its systems and locked portions of its cloud infrastructure, cutting off customer support channels, corporate email systems and hosting platforms for customers in Belarus and Russia, and that the company disclosed the attack on Tuesday.

By Wednesday, ActiveCloud said it had restored key parts of its infrastructure, though returning all customer systems online would take longer than initially expected. The company said Friday it restored main services while work continued to fix problems affecting individual customers. Most services are operational, though the firm said some customers may still struggle to restore virtual machines. “Our team has been working at full capacity, and today we can say that the most challenging phase is behind us,” ActiveCloud said.

ActiveCloud serves businesses and organizations with cloud hosting, virtual servers, corporate e-mail and related IT infrastructure. Among the affected products were E-Cloud, described as the main cloud hosting platform, E-Cloud Protected, which offers security protections, and SmartMail, the corporate e-mail service. Smartpress, a Belarusian news outlet, said its website runs on ActiveCloud infrastructure and that it kept publishing despite the outage.

Domino’s Pizza in Belarus saw temporary outages on its website and mobile app linked to technical problems, local media reported. ActiveCloud said its investigation found no sign of stolen customer data during the attack. ActiveCloud has not named those responsible or described the method used to enter its systems. No public evidence confirms a link between the ActiveCloud, ESTT and Beget attacks, and the companies have not named those responsible.

The ActiveCloud incident follows two major cyber attacks against Russian hosting providers earlier this month. This incident is the latest cyber attack aimed at hosting providers in Belarus and Russia over the past few weeks. On November 8, a ransomware attack hit Russian hosting company ESTT and disrupted its cloud infrastructure, cutting off customer access to websites, virtual servers and other online services. ESTT said hackers targeted its cloud management systems and that it found no evidence of customer data theft.

Days earlier, Russian hosting provider Beget experienced a destructive cyber attack where hackers accessed infrastructure management systems and deployed scripts that erased data from portions of its cloud environment. Beget’s attack knocked out websites and online services for businesses, news organizations and government agencies, while missing virtual server backups slowed recovery and forced infrastructure rebuilding.