Malicious Virtualizor Update Served via BGP Hijacking
A BGP hijack attack on Softaculous between August 28-30, 2026 diverted traffic to attacker-controlled servers, resulting in malicious Virtualizor update packages being delivered to a small number of installations The attacker exploited a more specific BGP route announcement from AS62390 (NexonHost) covering Hetzner's IP space, which took precedence under standard BGP route selection while retaining Hetzner's AS on the path A valid TLS certificate for Softaculous domains was obtained through Let'
Analysis
TL;DR
- A BGP hijack attack on Softaculous between August 28-30, 2026 diverted traffic to attacker-controlled servers, resulting in malicious Virtualizor update packages being delivered to a small number of installations
- The attacker exploited a more specific BGP route announcement from AS62390 (NexonHost) covering Hetzner's IP space, which took precedence under standard BGP route selection while retaining Hetzner's AS on the path
- A valid TLS certificate for Softaculous domains was obtained through Let's Encrypt because the CA's automated domain-ownership validation was also routed through the hijacked infrastructure
- Softaculous update clients lacked cryptographic verification of packages, meaning modified updates would not have been rejected; the company is now implementing code signing for all packages
- Only a small number of Virtualizor servers were affected, but Softaculous cannot produce a definitive list and urges all operators to check for compromises, reset passwords, and regenerate API keys
Why It Matters
This incident demonstrates how BGP hijacking can be combined with TLS certificate abuse to create a seemingly legitimate attack surface that bypasses standard security warnings, making it particularly dangerous for software supply chains. It highlights a critical gap in many auto-update systems that lack cryptographic verification, showing that even reputable hosting providers are vulnerable to infrastructure-level attacks that can compromise downstream users.
Technical Details
- BGP Hijack Mechanism: AS62390 (NexonHost) announced a more specific prefix of Hetzner's address space (162.55.0.0/16) at 20:57 UTC on August 28, 2026, which took precedence under standard BGP longest-prefix-match route selection while retaining AS24940 (Hetzner) on the AS path to appear legitimate
- TLS Certificate Compromise: The attacker obtained a valid Let's Encrypt TLS certificate for Softaculous domains because the CA's HTTP-01 or DNS-01 automated validation challenges were routed through the hijacked infrastructure, allowing the attacker to complete domain ownership verification
- Malicious Update Delivery: Virtualizor instances that checked for updates during the 22-hour intermittent hijack window (with an 11-hour gap mid-incident) received a modified update package; the update client did not cryptographically verify package integrity
- Mitigation Released: Virtualizor version 3.2.9.9 includes a mitigation tool for known exploits, and Softaculous is implementing a code signing mechanism for all future packages to prevent tampering
- Affected Scope: The compromised IP addresses served software updates, client area/billing, and other services; malicious traffic never reached Softaculous's logs, making definitive impact assessment impossible
Industry Insight
- Software vendors distributing updates over the internet must implement cryptographic code signing and signature verification as a baseline security measure; relying solely on TLS is insufficient when the underlying routing infrastructure can be compromised
- Organizations should treat BGP hijacking as a realistic threat vector and ensure their update mechanisms include out-of-band verification (e.g., signed checksums distributed through independent channels) rather than trusting a single network path
- Cloud and hosting providers should monitor for anomalous BGP announcements and implement RPKI (Resource Public Key Infrastructure) validation to reject illegitimate route origins, while also ensuring CA validation processes are resilient to routing manipulation
Disclaimer: The above content is generated by AI and is for reference only.