BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access
Attackers exploited a BGP hijack to divert Softaculous update traffic to a malicious server between August 28-30, delivering a compromised Virtualizor package to unsuspecting installations The malicious update established persistent root-level access via a systemd service, unauthorized SSH key injection, a rogue user account (proxyuser), and a Java-based payload downloading from C2 domains Virtualizor released Patch 9 with a Security Analyzer but acknowledged cryptographic package signing remain
Analysis
TL;DR
- Attackers exploited a BGP hijack to divert Softaculous update traffic to a malicious server between August 28-30, delivering a compromised Virtualizor package to unsuspecting installations
- The malicious update established persistent root-level access via a systemd service, unauthorized SSH key injection, a rogue user account (proxyuser), and a Java-based payload downloading from C2 domains
- Virtualizor released Patch 9 with a Security Analyzer but acknowledged cryptographic package signing remains unimplemented, leaving the ecosystem vulnerable to similar supply-chain attacks
- At least 5 of 34 hypervisor nodes at AlbaHost were confirmed compromised, though the full scope remains unknown due to the absence of an affected-version range or definitive compromised-server list
- Operators are urged to audit all servers, rotate API credentials, check for specific IoCs, and contact support before remediation to preserve forensic evidence
Why It Matters
This incident exemplifies how BGP-level infrastructure attacks can bypass traditional security perimeters to compromise software supply chains, directly undermining trust in automated update mechanisms. For AI practitioners and infrastructure operators relying on virtualization platforms, it underscores the critical importance of cryptographic code signing and the real-world consequences of deferred security investments.
Technical Details
- Attack vector: A BGP hijack redirected Softaculous update traffic to an attacker-controlled server; the attacker obtained a valid Let's Encrypt certificate to avoid TLS warnings, and the Virtualizor update client lacked cryptographic package verification, accepting the tampered package without rejection
- Persistence mechanisms: The payload installed a systemd service (
java-jre-update.service), injected an attacker-controlled SSH key into the root account, created an unauthorized account namedproxyuser, and established a root cron job to execute modified code within legitimate Virtualizor files - Payload delivery chain: The malicious script installed Java 17 if absent, downloaded a Java payload from C2 domains (
cdn.nerat.cc,connect.ne-rat.xyz), and executed it as root, with the payload cached at/usr/lib/jvm/.cache/jre-runtime.dat - Indicators of compromise: Includes specific file paths (
/tmp/widdow.jar,/usr/local/virtualizor/globals.php), injected strings, C2 domains, SSH key material (AAAAC3NzaC1lZDI1NTE5AAAAIP13pPAm5jmInLQYD3XNb3HwrW4cAKDcphoT4kSKrnte), and provider-reported IPs (193.32.127.248,31.77.220.138:2025) - Mitigation: Virtualizor Patch 9 includes a Security Analyzer (SHA-256:
73e74402b3a61c7bab289fc11347bd54c7fcdc2fa2e410f4c3de9d6cd7377d48); operators should rotate API keys, restrict SSH to trusted IPs, audit cron jobs and systemd services, and preserve evidence before remediation
Industry Insight
- Software vendors must prioritize cryptographic code signing for all update channels; the absence of this fundamental control enabled a relatively straightforward BGP hijack to become a full root compromise, setting a precedent for supply-chain attack feasibility
- Infrastructure operators should treat BGP monitoring and route-origin validation (e.g., RPKI) as essential security controls, not optional best practices, since routing-layer attacks can silently intercept update traffic without triggering traditional perimeter alerts
- The incident highlights a broader industry gap: many hosting and virtualization platforms operate update mechanisms without end-to-end integrity verification, creating systemic risk that extends beyond individual vendors to their entire customer base
Disclaimer: The above content is generated by AI and is for reference only.