BGP hijack pushed a malicious Virtualizor update

An attacker spent roughly 33 hours in late August rerouting a block of Hetzner IP addresses that Softaculous uses for software updates and its client billing portal, and used the diverted traffic to deliver a tampered Virtualizor update to a handful of servers. Softaculous disclosed the incident on September 1.

The hijack ran in two waves between 20:57 UTC on August 28 and 06:10 UTC on August 30, according to Softaculous. The attacker also obtained a valid TLS certificate for the affected domains by passing domain-validation checks through the hijacked route, so diverted connections showed no certificate warning. Any server that checked for a Virtualizor update while its network path was redirected could pull a package carrying a backdoor. Softaculous flagged a systemd unit at /etc/systemd/system/java-jre-update.service as an indicator of compromise and said it cannot produce a definitive list of affected installations. No malicious package was found for Webuzo, Softaculous, Backuply, or SitePad.

The technique is not new, but it usually fails at the last step because the payload still has to be trusted. Here it did not: Virtualizor and Softaculous ship unsigned update packages, so an attacker holding the network path and a valid certificate had nothing left to beat. Virtualizor 3.2.9.9, released September 1, adds a Security Analyzer tool to the admin panel, and Softaculous says cryptographic signing of all packages is now planned alongside a move to new infrastructure.

Anyone running Virtualizor should check for the systemd indicator, reset client-area passwords and API credentials, and review SSH keys, scheduled tasks, and outbound connections for anything added during the window. Softaculous also advised watching payment card statements, since the billing portal sat in the diverted address range.