Threat actors successfully diverted traffic from Softaculous update servers using BGP hijacking to deliver malicious updates to Virtualizor VPS management software. The vendor has issued an urgent warning and a security patch.

  • Attackers hijacked BGP routing for Hetzner-hosted IP addresses to redirect traffic.
  • Malicious Virtualizor update packages were delivered to a limited number of servers.
  • Vendor released version 3.2.9.9 with a built-in Security Analyzer tool.

In a sophisticated infrastructure-level attack, hackers targeted Virtualizor, a legacy VPS management control panel developed by Softaculous. By exploiting the Border Gateway Protocol (BGP), the attackers were able to reroute update requests from legitimate servers to malicious destinations, effectively poisoning the software update stream.

The incident occurred between August 28 (20:57 UTC) and August 30 (06:10 UTC). During this window, the threat actor falsely announced routes to a block of IP addresses hosted by Hetzner. Because BGP trusts these announcements, traffic intended for the Softaculous update systems and billing portal was diverted to the attackers' infrastructure.

Read Also:California Teenager Develops Biodegradable Paper Towels from Food Waste

Why This Matters

BozokMedia analysis shows that this incident highlights a systemic vulnerability in the global routing table. Unlike traditional phishing or malware, BGP hijacking occurs at the network layer, making it invisible to the end-user. If a vendor does not use cryptographic signing for its updates, the client software has no way of verifying if the update came from the real vendor or a malicious actor.

The lack of widespread RPKI adoption makes BGP hijacking a potent weapon for state-sponsored actors and advanced cybercriminals.

Softaculous confirmed that while the general user base remained safe, a "handful of servers" received the malicious update package. Because the requests were diverted before reaching the official servers, the company lacks comprehensive logs of all affected victims, shifting the burden of detection to the server administrators.

To mitigate the risk, admins are urged to check for the presence of the file /etc/systemd/system/java-jre-update.service. If discovered, it is critical to rotate API credentials, audit SSH keys, and monitor for unauthorized outbound connections. Users who entered payment details during the breach window are also advised to monitor their bank statements.

In response, Softaculous has released Virtualizor version 3.2.9.9, which introduces a "Security Analyzer" tool. To prevent future recurrences, the company is migrating to more robust infrastructure and implementing mandatory cryptographic signing for all software packages.

Did You Know?: BGP hijacking is often compared to a "GPS spoofing" attack for the internet, where the map is altered to lead drivers to a fake destination.

Frequently Asked Questions

Q1: Which specific file indicates a compromise?
The presence of /etc/systemd/system/java-jre-update.service on the server is a primary indicator of the malicious update.

Q2: What is the long-term fix implemented by Softaculous?
The company is implementing cryptographic signing for all packages, ensuring updates cannot be spoofed even if routing is hijacked.