---
title: "Beget destructive hosting attack"
description: "Beget reported that attackers reached management servers and launched data-deleting malware on November 2, 2026, Moscow time. It disconnected all servers to contain the attack."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-05"
canonical_url: "https://www.ally.security/incidents/beget-destructive-hosting-attack-2026"
markdown_url: "https://www.ally.security/incidents/beget-destructive-hosting-attack-2026.md"
stix_url: "https://www.ally.security/incidents/beget-destructive-hosting-attack-2026/stix.json"
---

# Beget destructive hosting attack

Beget reported that attackers reached management servers and launched data-deleting malware on November 2, 2026, Moscow time. It disconnected all servers to contain the attack.

Last modified Nov 5, 2026 · 1 source

## Summary

- **Environment:** Hosting management servers and customer services
- **Operational impact:** Servers disconnected; restoration remains incomplete
- **Financial impact:** No incident cost publicly quantified

## What happened

[Beget](https://beget.com/) reported that attackers reached management servers and launched data-deleting malware on November 2, 2026, Moscow time. It disconnected all servers to contain the attack. [1](#source-1)

## Impact

By November 5 at 15:00 MSK, Beget reported 60% of shared hosting and 40% of its managed dedicated servers restored. [1](#source-1)

## Timeline

### November 2, 2026 — Attack detected and servers disconnected (MSK)

Attack detected and servers disconnected (MSK), as described in the [incident notice](https://beget.com/en/security). [1](#source-1)

### November 3, 2026 — Mail services partly restored (MSK)

Mail services partly restored (MSK), as described in the [incident notice](https://beget.com/en/security). [1](#source-1)

### November 5, 2026 — Recovery percentages updated (MSK)

Recovery percentages updated (MSK), as described in the [incident notice](https://beget.com/en/security). [1](#source-1)

### November 5, 2026 — Briefing updated

This briefing was last reviewed and updated on November 5, 2026.

## Threat Group & Attack Vector

The notice describes destructive malware but does not establish the initial entry method or a named attacker. [1](#source-1)

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- T1485 — [Data Destruction](https://attack.mitre.org/techniques/T1485/). [1](#source-1)

## Response

Unmanaged dedicated servers and name servers returned on November 2. More than 80% of mail infrastructure and webmail returned November 3; shared-hosting websites began returning November 4. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/beget-destructive-hosting-attack-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Beget cyberattack recovery timeline, November 5 update

official · Beget

<https://beget.com/en/security>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   Beget destructive hosting attack: Attack detected and servers disconnected (MSK)
2. **Occurred At · 100% confidence · current**  
   Mail services partly restored (MSK): 2026-11-03
3. **Occurred At · 100% confidence · current**  
   Recovery percentages updated (MSK): 2026-11-05
4. **Resulted In · 100% confidence · current**  
   Beget destructive hosting attack: Beget reported that attackers reached management servers and launched data-deleting malware on November 2, 2026, Moscow time. It disconnected all servers to contain the attack.
5. **Resulted In · 100% confidence · current**  
   Beget destructive hosting attack: The notice describes destructive malware but does not establish the initial entry method or a named attacker.
6. **Resulted In · 100% confidence · current**  
   Beget destructive hosting attack: Mail services partly restored (MSK)
7. **Resulted In · 100% confidence · current**  
   Beget destructive hosting attack: By November 5 at 15:00 MSK, Beget reported 60% of shared hosting and 40% of its managed dedicated servers restored.
8. **Used Attack Technique · 100% confidence · current**  
   Beget destructive hosting attack: https://attack.mitre.org/techniques/T1485/
9. **Affected Organization · 100% confidence · current**  
   Beget destructive hosting attack: Beget
10. **Resulted In · 100% confidence · current**  
   Beget destructive hosting attack: Recovery percentages updated (MSK)
11. **Occurred At · 100% confidence · current**  
   Attack detected and servers disconnected (MSK): 2026-11-02
12. **Resulted In · 100% confidence · current**  
   Beget destructive hosting attack: Unmanaged dedicated servers and name servers returned on November 2. More than 80% of mail infrastructure and webmail returned November 3; shared-hosting websites began returning November 4.

</details>