The hijack began at around 20:57 UTC on August 28 when an unrelated network announced a block of Hetzner IP addresses used by Softaculous, causing some traffic to be routed to an attacker-controlled server. Hetzner, a German hosting provider, is one of Softaculous's upstream infrastructure providers. The affected addresses served a number of Softaculous systems, including Virtualizor's software update endpoint and Softaculous's client and billing site.
The attacker achieved the hijack by announcing a more specific IP address range than Hetzner normally advertised. Under standard BGP route selection, the more specific route took precedence wherever it was accepted. According to Softaculous, the attacker also obtained a valid TLS certificate from Let's Encrypt because the certificate authority's automated domain ownership validation was routed through the hijack, meaning affected connections reached the attacker's server without triggering certificate warnings.
Softaculous's timeline shows two waves of hijacking. The first wave, starting at 20:57 UTC on August 28, was initially accepted by essentially every internet vantage point but flapped repeatedly. Softaculous reported the issue to Hetzner at around 08:50 UTC on August 29, and Hetzner began announcing the same more-specific range, cutting the diversion to almost zero for roughly 11 hours. The unauthorized announcement returned at around 20:00 UTC, beginning a second wave lasting about ten hours. The route was withdrawn between 05:50 and 06:10 UTC on August 30.
During either wave, Softaculous estimates a given server had roughly a 72 percent chance of being on a network that routed the affected address range through the attacker. This figure is based on the proportion of RIPE routing collector peers carrying the hijacked route, not traffic volume.
The vendor confirmed that a malicious Virtualizor update package was delivered to a handful of installations whose update checks passed through the attacker's server. Softaculous noted that its product update clients did not yet cryptographically verify update packages, so a modified package would not have been rejected. Because those downloads never reached its own logs, Softaculous cannot produce a definitive list of affected installs and is therefore telling every Virtualizor operator to treat their server as in scope for checks – not necessarily as compromised.
Softaculous identified a systemd unit at /etc/systemd/system/java-jre-update.service as an indicator of compromise. Operators that find it are advised not to delete it immediately but to contact the vendor so evidence can be preserved. The vendor has not identified malicious packages targeting Backuply, Softaculous, SitePad, Webuzo, or other products.
Anyone who logged into the Softaculous client area during the incident window is advised to reset that password immediately, as well as anywhere else it was reused. Customers who entered card details during the same window should also review their statements. Softaculous said it does not process cards on its own servers and instead uses payment gateways, but an affected session may have been diverted before reaching them.