33-hour BGP hijack targets Softaculous, delivers malware to Virtualizor installations

Customers urged to reset passwords, inspect servers after traffic diverted to attacker-controlled system

edit
By LineZotpaper
Published
Read Time3 min
Softaculous and Virtualizor customers face a security scramble after a 33-hour BGP hijacking incident diverted traffic intended for the vendor's systems to an attacker-controlled server, resulting in a malicious update package being delivered to a handful of Virtualizor installations. The vendor is urging all users to reset credentials and check for indicators of compromise.

The hijack began at around 20:57 UTC on August 28 when an unrelated network announced a block of Hetzner IP addresses used by Softaculous, causing some traffic to be routed to an attacker-controlled server. Hetzner, a German hosting provider, is one of Softaculous's upstream infrastructure providers. The affected addresses served a number of Softaculous systems, including Virtualizor's software update endpoint and Softaculous's client and billing site.

The attacker achieved the hijack by announcing a more specific IP address range than Hetzner normally advertised. Under standard BGP route selection, the more specific route took precedence wherever it was accepted. According to Softaculous, the attacker also obtained a valid TLS certificate from Let's Encrypt because the certificate authority's automated domain ownership validation was routed through the hijack, meaning affected connections reached the attacker's server without triggering certificate warnings.

Softaculous's timeline shows two waves of hijacking. The first wave, starting at 20:57 UTC on August 28, was initially accepted by essentially every internet vantage point but flapped repeatedly. Softaculous reported the issue to Hetzner at around 08:50 UTC on August 29, and Hetzner began announcing the same more-specific range, cutting the diversion to almost zero for roughly 11 hours. The unauthorized announcement returned at around 20:00 UTC, beginning a second wave lasting about ten hours. The route was withdrawn between 05:50 and 06:10 UTC on August 30.

During either wave, Softaculous estimates a given server had roughly a 72 percent chance of being on a network that routed the affected address range through the attacker. This figure is based on the proportion of RIPE routing collector peers carrying the hijacked route, not traffic volume.

The vendor confirmed that a malicious Virtualizor update package was delivered to a handful of installations whose update checks passed through the attacker's server. Softaculous noted that its product update clients did not yet cryptographically verify update packages, so a modified package would not have been rejected. Because those downloads never reached its own logs, Softaculous cannot produce a definitive list of affected installs and is therefore telling every Virtualizor operator to treat their server as in scope for checks – not necessarily as compromised.

Softaculous identified a systemd unit at /etc/systemd/system/java-jre-update.service as an indicator of compromise. Operators that find it are advised not to delete it immediately but to contact the vendor so evidence can be preserved. The vendor has not identified malicious packages targeting Backuply, Softaculous, SitePad, Webuzo, or other products.

Anyone who logged into the Softaculous client area during the incident window is advised to reset that password immediately, as well as anywhere else it was reused. Customers who entered card details during the same window should also review their statements. Softaculous said it does not process cards on its own servers and instead uses payment gateways, but an affected session may have been diverted before reaching them.

§

Analysis

Why This Matters

  • BGP hijacks silently redirect internet traffic, and can be used to intercept or modify data even over HTTPS if the attacker obtains a valid certificate, as happened here.
  • The compromise of an update mechanism (Virtualizor) illustrates supply-chain risks; a handful of installations received malware via a trusted channel, and without cryptographic verification, users had no way to detect the tampering.
  • The incident underscores the fragility of BGP routing security and the potential for large-scale impact from a single targeted hijack affecting a hosting provider and its customers.

Background

BGP (Border Gateway Protocol) is the routing protocol that governs how traffic moves across the internet. It relies on trust: networks announce IP prefixes and other networks propagate those announcements. Hijacks occur when a network falsely announces a prefix it does not own, diverting traffic. Mitigations like RPKI (Resource Public Key Infrastructure) exist but are not universally deployed. This hijack targeted Softaculous, a company that provides software for web hosting, and its Virtualizor control panel, used to manage virtual private servers.

Key Perspectives

  • Softaculous (vendor): Acted quickly once aware, coordinated with Hetzner, advised users to reset credentials and check for compromise. Its lack of cryptographic verification for updates is a security gap it acknowledges.
  • Hetzner (upstream provider): Responded by announcing the more specific route to reclaim traffic, but the attacker's route returned after an 11-hour lull.
  • Attacker: Unknown entity that executed a technically sophisticated attack combining BGP hijacking with valid certificate acquisition to avoid detection. Motivation and identity remain unknown.
  • Customers and Virtualizor operators: Facing uncertainty; must assume potential compromise and scour servers without a definitive list of affected installs.

What to Watch

  • Results of fornsic investigation into the malware delivered via the hijacked update; capabilities could range from data theft to persistence.
  • Softaculous's response: likely to implement cryptographic signing for update packages to prevent future tampering.
  • Adoption of RPKI by hosting providers and ISPs; this incident may spur calls for stronger BGP security measures.
  • Potential legal or regulatory action, especially given the involvement of a major hosting provider and a certificate authority (Let's Encrypt).

Sources

newspaper

Zotpaper

Articles published under the Zotpaper byline are synthesized from multiple source publications by our AI editor and reviewed by our editorial process. Each story combines reporting from credible outlets to give readers a balanced, comprehensive view.