{
  "id": 16752012,
  "title": "The read-only disk mount that left no trace on the server",
  "url": "https://urgent.news/2026/10/27/the-read-only-disk-mount-that-left-no-trace-on-the-server",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-27T14:00:53.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/andreagomez/the-read-only-disk-mount-that-left-no-trace-on-the-server-1ocl"
  },
  "original_language": "en",
  "account": "The FirstVDS hosting provider disclosed an unusual incident on October 19, 2026, where attackers accessed customer virtual servers without directly compromising them. Instead, the malware mounted the servers' disks in read-only mode, copied the contents, and the servers continued to operate normally. Notably, there were no traces of the attack on the affected virtual servers, making detection challenging for tenants relying solely on monitoring guest operating systems.\n\nThis read-only disk mount occurred at the hypervisor level, which means it is recorded in the management platform's audit trail, storage layer's access records, and the hypervisor's own logs. However, these records are not visible to guest-side agents, making them undetectable from within the compromised servers.\n\nTo detect such attacks, providers should look for read-only attaches that were not initiated by scheduled backups or by accounts typically not involved in storage operations. Conversely, tenants should ensure their hosting contracts include access to an audit feed for management actions affecting their instances. When notified of a breach, customers should assume their data may have been stolen and take necessary actions, such as rotating private keys, even if rebuilding a server from a clean image proves ineffective if credentials remain unchanged.\n\nZoomEye, a monitoring service, can identify the number of reachable management interfaces. On October 27, 2026, it reported 2,823 assets using the query \"title= VMmanager.\" However, this information alone cannot determine whether the management platforms log disk attaches, as this is an internal configuration decision. Detecting evidence of compromise therefore requires access to the provider's internal audit trail, which is beyond the scope of external scanning.",
  "summary": "The read-only disk mount that left no trace on the server FirstVDS described an unusual detail in its 19 October 2026 disclosure. The intruder did not compromise the customer virtual machines directly. The malware mounted their disks in read-only mode, copied the contents, and left the servers running normally. The provider's own wording is that \"there are no traces of the attack on the affected…",
  "key_points": [
    "Attackers mounted customer virtual servers disks in read-only mode on Oct 19, 2026.",
    "No traces of attack on affected virtual servers, making detection difficult.",
    "Detect attacks by monitoring read-only attaches not initiated by backups or non-storage accounts."
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}