Full Report
Virtualizor said hackers used a Border Gateway Protocol (BGP) hijack to divert Softaculous traffic. The hackers then used the diverted update traffic to deliver a malicious Virtualizor package to some installations. A hosting-provider account separately said 5 of its 34 checked Virtualizor hypervisors sustained root-level compromise. The incident window ran from approximately August 28 at 20:57
Analysis Summary
# Incident Report: BGP Hijack and Supply Chain Compromise of Virtualizor
## Executive Summary
Virtualizor, a popular VPS management software, suffered a supply chain attack facilitated by a Border Gateway Protocol (BGP) hijack of Softaculous traffic. Attackers diverted update traffic to a malicious server to deliver compromised software packages, resulting in root-level access on affected hypervisors. The incident highlights critical vulnerabilities in software update mechanisms that lack cryptographic signing.
## Incident Details
- **Discovery Date:** September 1, 2026 (Patch release date)
- **Incident Date:** August 28, 2026 – August 30, 2026
- **Affected Organization:** Virtualizor (Vendor) and multiple hosting providers (e.g., AlbaHost)
- **Sector:** Information Technology / Web Hosting / Cloud Infrastructure
- **Geography:** Global (Network-level attack)
## Timeline of Events
### Initial Access
- **Date/Time:** August 28, 2026, at 20:57:30 UTC.
- **Vector:** BGP Hijack.
- **Details:** Attackers announced unauthorized routes for the IP range `162.55.80.0/24`, diverting Softaculous/Virtualizor update traffic to an attacker-controlled server.
### Lateral Movement
- **Details:** Upon successful installation of the malicious update, the attackers gained root access. They established a new systemd service (`java-jre-update.service`) and created an unauthorized user account named `proxyuser` to facilitate persistent SSH access.
### Data Exfiltration/Impact
- **Details:** Attackers obtained root-level control over at least 5 of 34 hypervisors at one hosting provider. Potential theft of client-area session cookies and payment data for users who logged in during the diversion window. No independent confirmation of full database exports has been reported yet.
### Detection & Response
- **Discovery:** Hosting providers (e.g., AlbaHost) identified malicious modifications in three core Virtualizor files and unauthorized root SSH keys.
- **Response Actions:** Virtualizor released "Patch 9" on September 1, including a Security Analyzer tool. Affected providers began auditing hypervisors and rotating credentials.
## Attack Methodology
- **Initial Access:** BGP Hijacking to intercept and redirect update traffic.
- **Persistence:** Created a `systemd` service (`java-jre-update.service`) and a root-level cron job.
- **Privilege Escalation:** Malicious code was executed during the update process, which naturally runs with root privileges.
- **Defense Evasion:** Obtained a valid Let's Encrypt SSL certificate during the BGP hijack to prevent browser/client certificate warnings.
- **Credential Access:** Added an attacker-controlled SSH key to the root account; potential theft of API keys and payment data.
- **Discovery:** The script checked for the presence of Java 17 and downloaded it if missing.
- **Lateral Movement:** SSH access via the `proxyuser` account from IP `193.32.127[.]248`.
- **Collection:** Interception of client-area sessions and payment-entry traffic.
- **Exfiltration:** Potential database exports (unconfirmed).
- **Impact:** Root-level compromise of hypervisors; potential compromise of hosted Virtual Private Servers (VPS).
## Impact Assessment
- **Financial:** Unknown; potential loss due to credit card fraud if payment data was captured.
- **Data Breach:** High risk of stolen API credentials and session tokens.
- **Operational:** Disruption to hosting providers who had to audit and potentially reinstall hypervisors.
- **Reputational:** Significant damage to Virtualizor due to the lack of cryptographic package signing.
## Indicators of Compromise
- **Network:** `193.32.127[.]248` (Attacker SSH source)
- **File:** `/etc/systemd/system/java-jre-update.service`
- **Behavioral:**
- Presence of unauthorized user `proxyuser`.
- Unauthorized SSH keys in `/root/.ssh/authorized_keys`.
- Unexpected Java 17 installations on hypervisors.
- Modified Virtualizor system files.
## Response Actions
- **Containment:** Restricted API and SSH access to trusted IP addresses.
- **Eradication:** Use of the Virtualizor Security Analyzer to identify and remove malicious files/services.
- **Recovery:** Rotating all API keys, regenerating Client Center keys, and resetting user passwords.
## Lessons Learned
- **Cryptographic Signing:** The absence of package signing allowed the update client to trust a malicious payload simply because it was delivered from the "correct" (though hijacked) IP.
- **BGP Vulnerability:** Reliance on IP-based trust remains a significant risk for global software distribution.
- **Audit Logging:** Detailed logging by the hosting provider allowed for the identification of the specific attacker IP and modified files.
## Recommendations
1. **Immediate:** Run the official Virtualizor scanner on all nodes, regardless of version.
2. **Hardening:** Implement IP whitelisting for all SSH and API access.
3. **Monitoring:** Implement BGP monitoring alerts to detect unauthorized route announcements for critical infrastructure IPs.
4. **Policy:** Virtualizor must prioritize the implementation of cryptographic package signing to ensure integrity regardless of the delivery path.