Virtualizor warns of BGP hijack that pushed a malicious update

Virtualizor, the VPS control panel from Softaculous, has published a security incident report saying attackers used a BGP hijack to divert its update traffic and deliver a malicious update to a small number of servers. The route diversion was broad, visible across most of the internet's public routing monitors, but the confirmed damage is a handful of installations that happened to check for updates while the hijack was live.

The hijack ran for about 33.3 hours, from roughly 20:57 UTC on August 28 to 06:10 UTC on August 30, in two waves with an eleven-hour lull in between. During that window, any Virtualizor panel reaching out for an update could have been served a tampered package instead of the real one.

The attackers announced a more-specific route for 162.55.80.0/24, a slice of Hetzner address space normally covered by the wider 162.55.0.0/16 announcement. Because routers prefer the more-specific route, traffic to update servers in that range followed the fake path, which ran through AS62390 (NexonHost) and transit AS6204 (Zet.net) while keeping Hetzner's AS24940 on the tail so it still looked like the legitimate origin.

To seal the illusion, the attacker obtained a technically valid Let's Encrypt certificate covering Virtualizor and Softaculous domains, so victims saw no certificate warning. The routing layer itself became the weapon, a cousin of the router-level intrusions in the Fire Ant campaign against Cisco IOS XR.

The reason a tampered update was accepted is blunt, and the vendor states it plainly: "Our product update clients did not yet cryptographically verify update packages, so a modified package would not have been rejected."

The indicator the vendor published is a systemd unit at /etc/systemd/system/java-jre-update.service. Virtualizor says a host with that unit present, enabled, or running is compromised, and asks operators not to simply delete it. The company wants affected operators to contact them, because a malicious response never touched the vendor's own logs, so they cannot produce a complete victim list.

Virtualizor has shipped version 3.2.9.9 with a mitigation tool, and says cryptographic code signing for update packages is coming. The advisory also tells operators to rotate and restrict API keys, audit SSH access, users and cron jobs, run the optional scan script hosted on files.virtualizor.com, and reset the client-area password if they logged in during the hijack window.

No malicious package has been confirmed for the sibling products Webuzo, Softaculous, Backuply, or SitePad, but the investigation is open. The incident is a targeted diversion of a handful of hosts, not a mass worm, and there is no single CVE to track, only a poisoned update channel.

Some offers on this page may be paid placements or contain affiliate links.