What happened to CloudCone? Was it hacked?

vpsam · February 1

I contacted HostSlick yesterday and got the response below. I reset the VPS but today it's down again and no access to the panel, though I'm hoping it's because of the migration to VirtFusion they mentioned. Either way, the lack of communication isn't great. They should have just sent this out.

The reason your VPS is currently down is due to an incident that occurred yesterday at 23:51 CET. An attacker exploited a vulnerability in Virtualizor and gained access to our main node.

The attacker then used the terminal function to access additional nodes and overwrite some VPS instances. Specifically, the first 512 MB and the boot header were overwritten with zeros, and a ransom notification was placed. This ransom message appears to be a scam. If you open the HTML5 console and see a message stating that your data is encrypted and that payment is required, please do not follow those instructions.

Please note the following important points:
1. Your data is not encrypted. Only the boot header was zeroed, which prevents the VPS from booting.
2. Your data remains safe and no personal or customer data was compromised.
3. We have isolated the affected nodes and manually removed the terminal function that was abused. This attack is currently affecting multiple hosting providers, and we are not the only ones impacted. You can find similar reports on forums such as LowEndTalk.

We are working very hard on recovery. Virtualizor has been fully isolated and the affected feature has been removed, which may now return a 50x error. We are also proceeding with our previously planned migration to a different VPS control panel called VirtFusion. This migration was already scheduled as part of our Q3 2025 roadmap, alongside a full revamp of our VPS and Hybrid product line starting with 10 Gbit connectivity.

As part of this process, our current product line has been taken out of sale.

We believe the attackers may have gained access through the Virtualizor master credentials, potentially linked to a breach of their support center last year. We were notified a few months ago that this breach had been identified, and we believe there may be a connection between these events.

To continue using your VPS, you may need to restore from your local backups, reinstall the VPS, and upload your data again.

Unfortunately, there is currently no automated way to recover the affected VPS instances. The first 512 MB and the boot header were permanently zeroed by the attacker’s script, which we have analyzed. While we attempted to automate recovery over the past several hours, this was not successful. The only possible recovery method would involve forensic tools such as PhotoRec to extract data from the raw or QCOW2 virtual disks. This process is extremely time consuming and can take many hours per VPS.

Thank you for your understanding.

beadcf · February 1

@lowendlurker said:

@beadcf said:
Hostslick VM too

No interaction with the VM in the panel for you as well?

8 hours ago worked, but I couldn't connect via SSH even though it was online.
Now the VPS still responds to the Ping, but nothing else works.

lowendlurker · February 1

I don’t have a backup of that data.
But that’s actually fine, because the server only contained backups anyway.
If Everything is gone. Nothing is lost.

ralf · February 1

Yeah, I'm surprised that while he's been very open here, there's not been a single email to customers, not even a "your server is down" message. Just nothing at all.

sunkiss · February 1

72 hours have passed.
If it's clear that user data cannot be recovered, why can't users be allowed to access their VPS to reinstall the system?
What exactly is the difficulty here?

tentor · February 1

@sunkiss said:
What exactly is the difficulty here?

It is weekends, I think staff availability is limited. Rush after security incident is risky and could result in a repeated attack soon

ralf · February 1

@tentor said:

@sunkiss said:
What exactly is the difficulty here?

It is weekends, I think staff availability is limited. Rush after security incident is risky and could result in a repeated attack soon

Also $7/y level support

host_c · February 1

@ralf said:

@tentor said:

@sunkiss said:
What exactly is the difficulty here?

It is weekends, I think staff availability is limited. Rush after security incident is risky and could result in a repeated attack soon

Also $7/y level support

If they are in business for a long time, surely they have Business customers also, and my money is that those will take precedence in trying to fix what is broken.

@tentor is right, rushing in and restarting provisions of services without being 100% confident that the network is not compromised anymore would be a cluster-fuck right now. The damage is done, so 1,2,3 days more would make little difference on their image, a second hack would definitely blow them to the dust.

I hope that they manage to secure their network and start re-provisioning systems on a clean install/fixed infrastructure.

lowendlurker · February 1

@ralf said:

@tentor said:

@sunkiss said:
What exactly is the difficulty here?

It is weekends, I think staff availability is limited. Rush after security incident is risky and could result in a repeated attack soon

Also $7/y level support

38€/y and still not able to do anything

pendy100 · February 1

@oloke said:
This doesn't look great. I hope not all customers have been encrypted.
Something like this happened to Colocrossing as well last year.

In any case DO NOT PAY the ransom as it will only incentivize extortionists.
They most likely won't give your data back anyway.

Please restore it quickly; I have important services running on it.

I just hope you have good backups of those important services.

Stop dreaming. They've made it clear that there are no data backups. And not only will they not offer compensation, they won't even give a refund. Every support ticket I submit gets the same response, and they immediately close it, preventing me from replying again. This is the first time I've ever encountered such an irresponsible company.

ralf · February 1

@pendy100 said:

@oloke said:
This doesn't look great. I hope not all customers have been encrypted.
Something like this happened to Colocrossing as well last year.

In any case DO NOT PAY the ransom as it will only incentivize extortionists.
They most likely won't give your data back anyway.

Please restore it quickly; I have important services running on it.

I just hope you have good backups of those important services.

Stop dreaming. They've made it clear that there are no data backups. And not only will they not offer compensation, they won't even give a refund. Every support ticket I submit gets the same response, and they immediately close it, preventing me from replying again. This is the first time I've ever encountered such an irresponsible company.

He said: I just hope you have good backups of those important services.

Do you have good backups? Not your provider, you.

fredo1664 · February 1

@ralf said:

@pendy100 said:

@oloke said:
This doesn't look great. I hope not all customers have been encrypted.
Something like this happened to Colocrossing as well last year.

In any case DO NOT PAY the ransom as it will only incentivize extortionists.
They most likely won't give your data back anyway.

Please restore it quickly; I have important services running on it.

I just hope you have good backups of those important services.

Stop dreaming. They've made it clear that there are no data backups. And not only will they not offer compensation, they won't even give a refund. Every support ticket I submit gets the same response, and they immediately close it, preventing me from replying again. This is the first time I've ever encountered such an irresponsible company.

He said: I just hope you have good backups of those important services.

Do you have good backups? Not your provider, you.

It's always the same with people who don't make any backup and then create drama when they lose their precious data. It's even in the T&C that they agreed upon when signing with Cloudcone:

"Customer agrees to maintain a current copy of all content hosted by CloudCone notwithstanding any agreement by CloudCone to provide backup services."

oloke · February 1

@pendy100 said:

@oloke said:
This doesn't look great. I hope not all customers have been encrypted.
Something like this happened to Colocrossing as well last year.

In any case DO NOT PAY the ransom as it will only incentivize extortionists.
They most likely won't give your data back anyway.

Please restore it quickly; I have important services running on it.

I just hope you have good backups of those important services.

Stop dreaming. They've made it clear that there are no data backups. And not only will they not offer compensation, they won't even give a refund. Every support ticket I submit gets the same response, and they immediately close it, preventing me from replying again. This is the first time I've ever encountered such an irresponsible company.

zh:

sr3 · February 1

Alright fine. If there was a fire on the servers I'd understand, mechanical disk failure sure that happens.

But this was neglect. Pure and simple. Like sorry we dropped a bucket of water on the rack that had your server. What? Why was there a bucket of water in the server room!

CloudCone simply doesn't deserve anyone's trust for anything ever.

I hope they get sued out of existence.

sr3 · February 1

I had my server and my backup on the same node because it was faster.

Both now gone.

Asked for the raw disks so I could try and buy my key. CC says no.

Great job

Saragoldfarb · February 1

@sr3 said:
I had my server and my backup on the same node because it was faster.

Both now gone.

Asked for the raw disks so I could try and buy my key. CC says no.

Great job

So you cut a corner and got burned? Rough.

barbaros · February 1

Hello CloudCone can you please check my KYC ticket? Thanks!

forest · February 2

@sr3 said: But this was neglect. Pure and simple. Like sorry we dropped a bucket of water on the rack that had your server. What? Why was there a bucket of water in the server room!

We don't know if it was neglect. All we have now is speculation.

Cloudcone · February 2

Update:

Certain clients can now re-install their VPSs directly through the client area.

If you see a banner on your VM management page similar to this, you're good to proceed with a re-install and begin restoring backups.

The nodes / hypervisors for the affected users have been re-installed, further hardened, and locked down.
The Virtualizor control panel has been re-installed and further locked down.
All passwords, API keys have been rotated
Client area operations other than re-installing has been locked temporarily

We understand the impact this has caused for both our clients and ourselves. We explored data recovery options, but unfortunately, they were not successful.

Our teams are working around the clock to bring the rest of the affected infrastructure back online so clients can restore their backups.

Additionally, we want to inform that we will be moving to an in-house cloud orchestrator that will silently replace Virtualizor. Timelines are between February and March 2026.

Further incident details will follow on our status page: https://status.cloudcone.com/incidents/346624

forest · February 2

@Cloudcone said: We understand the impact this has caused for both our clients and ourselves. We explored data recovery options, but unfortunately, they were not successful.

Are the encrypted images still available for customers who want to boot into a rescue ISO and run photorec themselves?

sr3 · February 2

@forest said:

@Cloudcone said: We understand the impact this has caused for both our clients and ourselves. We explored data recovery options, but unfortunately, they were not successful.

Are the encrypted images still available for customers who want to boot into a rescue ISO and run photorec themselves?

I asked that on the ticket and they just closed the ticket with: this as already been answered. I'm so pissed.

ralf · February 2

@sr3 said:

@forest said:

@Cloudcone said: We understand the impact this has caused for both our clients and ourselves. We explored data recovery options, but unfortunately, they were not successful.

Are the encrypted images still available for customers who want to boot into a rescue ISO and run photorec themselves?

I asked that on the ticket and they just closed the ticket with: this as already been answered. I'm so pissed.

If they have just left the disk images alone with the ransomware boot sector etc still intact, as long as you can mount your own ISO and use VNC, that's probably enough to do what you want.

FWIW, @HostSlick still haven't even sent out any communication at all about this, nor can you turn on the machine using the panel yet.

duchenpaul · February 2

Looks like the service is still down, as seen in the status page, the uptime is now 94.06%, according to their SLA, looks like we can ask them for the full refund, correct me if I were wrong.

duchenpaul · February 2

And there has not been any makeups to the customers, which is quite disappointing.

zed · February 2

were the miscreants state-sponsored hackers?

ralf · February 2

@duchenpaul said:
Looks like the service is still down, as seen in the status page, the uptime is now 94.06%, according to their SLA, looks like we can ask them for the full refund, correct me if I were wrong.

I guess "Downtime for hardware failures and events out of CloudCone’s control are not applicable for credit"

Also, normally SLA credit are done on a monthly basis by most providers.

EDIT: also credit not refund.

duchenpaul · February 2

@ralf said:

@duchenpaul said:
Looks like the service is still down, as seen in the status page, the uptime is now 94.06%, according to their SLA, looks like we can ask them for the full refund, correct me if I were wrong.

I guess "Downtime for hardware failures and events out of CloudCone’s control are not applicable for credit"

Also, normally SLA credit are done on a monthly basis by most providers.

EDIT: also credit not refund.

Yikes, I am one of the victims, luckily I don't have anything I care on that machine. Thanks for your explaination, let's how it goes forward.

justyy · February 2

I've checked with @DediRock and here is their reply:

Thank you very much for the info. We are reviewing our security protocols with the Virtualizor team. We can say, though, our Virtualizor end-user panel is and has been disabled for quite some time, so our security protocols are in place. We are currently reviewing with Virtualizor if there is anything else that we need to touch up on. Thank you very much again.

sunkiss · February 2

Day4: Still unable to reinstall the operating system.

Task：RebuildingVPS=Stuck in an infinite loop.

nhuttran · February 2

Long time CloudCone customer here. There is no such email about informing the incident to customer. Not until contact support yourself. No compensation - agree on client should have their own backup, but server is still not functioning, client should receive refund/credits according SLA, no clear communication, no alternative solution / workaround for customers ... ex allow restore to migrate to different region,.. nothing but endless wait.

I'm luckily that have all my weekly backup on R2, and already start restoring data to other provider. People who care about their business, should already move on by now. I DO NOT recommend paying hacker to restore your data, it is all SCAM.

Howdy, Stranger!

Categories

In this Discussion

What happened to CloudCone? Was it hacked?

Comments

Howdy, Stranger!

Quick Links

Categories

In this Discussion

What happened to CloudCone? Was it hacked?

Comments