The VMmanager 6 server management platform, developed by ISPsystem (a subsidiary of Astra Group), has suffered a security breach. The incident, confirmed by the developer, involves a vulnerability in one of the platform's builds. The platform is used by both private companies and government organizations, with over 6,000 servers reportedly running the software as of 2025.
The attack occurred on October 17, 2026. According to hosting provider FirstVDS, attackers exploited the vulnerability to gain unauthorized access to infrastructure. Malicious software was deployed to copy sensitive data from virtual servers, including passwords, SSH and API keys, configuration files, command history, and cryptocurrency wallet data.
Hosting provider ForestsNet Cloud reported that VMmanager panels were compromised between October 11 and October 16, 2026, with the data theft occurring on the night of October 16–17. Providers have begun notifying affected clients. Astra Group is currently conducting an investigation and maintaining contact with customers but has not disclosed the full scale of the breach.
The potential impact extends beyond the affected servers, as compromised credentials could grant attackers access to external cloud environments, code repositories, and automated build systems. Astra Group acquired a 70% stake in ISPsystem in March 2022 for 2.5 ₽ billion, with CEO Pavel Guralnik retaining the remaining 30%.
