The read-only disk mount that left no trace on the server

The FirstVDS hosting provider disclosed an unusual incident on October 19, 2026, where attackers accessed customer virtual servers without directly compromising them. Instead, the malware mounted the servers' disks in read-only mode, copied the contents, and the servers continued to operate normally. Notably, there were no traces of the attack on the affected virtual servers, making detection challenging for tenants relying solely on monitoring guest operating systems.

This read-only disk mount occurred at the hypervisor level, which means it is recorded in the management platform's audit trail, storage layer's access records, and the hypervisor's own logs. However, these records are not visible to guest-side agents, making them undetectable from within the compromised servers.

To detect such attacks, providers should look for read-only attaches that were not initiated by scheduled backups or by accounts typically not involved in storage operations. Conversely, tenants should ensure their hosting contracts include access to an audit feed for management actions affecting their instances. When notified of a breach, customers should assume their data may have been stolen and take necessary actions, such as rotating private keys, even if rebuilding a server from a clean image proves ineffective if credentials remain unchanged.

ZoomEye, a monitoring service, can identify the number of reachable management interfaces. On October 27, 2026, it reported 2,823 assets using the query "title= VMmanager." However, this information alone cannot determine whether the management platforms log disk attaches, as this is an internal configuration decision. Detecting evidence of compromise therefore requires access to the provider's internal audit trail, which is beyond the scope of external scanning.