Full Report
Hosting software vendor tells customers to reset credentials and hunt for malicious packages
Analysis Summary
# Incident Report: Softaculous BGP Hijack & Malware Distribution
## Executive Summary
Softaculous and Virtualizor experienced a significant 33-hour BGP hijacking incident that diverted traffic to attacker-controlled infrastructure. By exploiting a lack of cryptographic signature verification in software updates, attackers delivered malicious packages to a "handful" of servers and likely harvested client credentials and financial data. The incident was mitigated after the upstream provider (Hetzner) and the attackers ceased the conflicting route announcements.
## Incident Details
- **Discovery Date:** August 29, 2026, 08:50 UTC
- **Incident Date:** August 28, 2026 – August 30, 2026
- **Affected Organization:** Softaculous (and its Virtualizor product)
- **Sector:** Web Hosting Software / Infrastructure
- **Geography:** Global (Upstream infrastructure via Hetzner, Germany)
## Timeline of Events
### Initial Access
- **Date/Time:** August 28, 2026, 20:57 UTC
- **Vector:** BGP Route Hijacking
- **Details:** An unrelated network announced a more specific IP prefix for Hetzner-hosted Softaculous IP ranges. This diverted approximately 72% of global traffic to an attacker-controlled server.
### Lateral Movement
- **N/A:** The attack focused on "Man-in-the-Middle" (MitM) positioning to intercept client traffic and push malicious updates rather than traditional internal lateral movement.
### Data Exfiltration/Impact
- **Malware Delivery:** Malicious Virtualizor updates were served to clients connecting during the hijack window.
- **Credential Theft:** Potential harvesting of client area passwords and payment card details entered during the 33-hour window.
- **SSL Spoofing:** Attackers successfully obtained valid Let’s Encrypt certificates by passing domain validation challenges while traffic was diverted.
### Detection & Response
- **08:50 UTC, Aug 29:** Softaculous detected the anomaly and reported it to Hetzner.
- **Aug 29 (Daytime):** Hetzner counter-announced the specific prefix, neutralizing the hijack for 11 hours.
- **20:00 UTC, Aug 29:** Attackers resumed the hijack (Second Wave).
- **06:10 UTC, Aug 30:** Unauthorized routes were withdrawn; normal routing restored.
## Attack Methodology
- **Initial Access:** BGP Hijacking (Layer 3 routing manipulation).
- **Persistence:** Installation of a malicious `systemd` unit on compromised Virtualizor servers.
- **Privilege Escalation:** Not specified, but the software update mechanism typically runs with high privileges (root/admin).
- **Defense Evasion:** Use of legitimate Let’s Encrypt SSL certificates to prevent browser/client warnings.
- **Credential Access:** MitM interception of login forms and billing pages.
- **Impact:** Delivery of unauthorized software packages and theft of PII/Financial data.
## Impact Assessment
- **Financial:** Potential theft of credit card data from users attempting transactions during the window.
- **Data Breach:** Compromise of client area credentials and billing information.
- **Operational:** "Handful" of Virtualizor servers confirmed infected; requirement for all customers to perform manual audits.
- **Reputational:** High; incident highlights a lack of cryptographic signing for software updates.
## Indicators of Compromise
- **File indicators:** `/etc/systemd/system/java-jre-update.service`
- **Behavioral indicators:** Unauthorized SSH keys in `authorized_keys`, unknown scheduled tasks (cron), and unexpected outbound connections to unrecognized IPs.
## Response Actions
- **Containment:** Coordinated with Hetzner to announce more specific BGP prefixes to reclaim traffic.
- **Eradication:** Invalidated all client-area sessions created during the incident window.
- **Recovery:** Advised customers to reset passwords, rotate API keys, and audit servers for the identified `systemd` service.
- **Evidence Preservation:** Requested customers finding the IOC not to delete it, but to contact support for forensic analysis.
## Lessons Learned
- **BGP Vulnerability:** Relying on standard BGP without monitoring or RPKI (Resource Public Key Infrastructure) allows for wide-scale traffic diversion.
- **Supply Chain Security:** The lack of cryptographic verification for update packages allowed a MitM attacker to execute remote code on client servers easily.
- **Trust Validation:** Automated SSL certificate issuance (HTTP-01 challenges) can be subverted if the underlying routing is compromised.
## Recommendations
- **Implement Code Signing:** Softaculous must implement cryptographic signatures for all update packages to ensure integrity even if the transport layer is compromised.
- **BGP Security:** Enable RPKI and ROA (Route Origin Authorization) to prevent unauthorized prefix announcements.
- **Enhanced Monitoring:** Implement real-time BGP monitoring to alert on unauthorized route advertisements immediately.
- **Multi-Factor Authentication (MFA):** Encourage all clients to use MFA to mitigate the impact of stolen credentials.