Full Report
Hackers delivered malicious updates to the Virtualizor VPS management software after hijacking BGP routing for its update infrastructure and redirecting update requests to malicious servers. [...]
Analysis Summary
# Incident Report: Virtualizor Supply Chain Attack via BGP Hijacking
## Executive Summary
Between August 28 and August 30, 2026, threat actors executed a BGP hijacking attack against Softaculous infrastructure to intercept traffic intended for Virtualizor update servers. By redirecting update requests to malicious servers, the attackers delivered compromised software packages to a subset of Virtualizor VPS management installations. The vendor has since restored routing, released a security analyzer tool, and advised affected users to rotate credentials and audit for backdoors.
## Incident Details
- **Discovery Date:** August 30 - September 1, 2026
- **Incident Date:** August 28, 20:57 UTC – August 30, 06:10 UTC
- **Affected Organization:** Softaculous (Virtualizor)
- **Sector:** Information Technology / Web Hosting Software
- **Geography:** Global (Infrastructure hosted via Hetzner)
## Timeline of Events
### Initial Access
- **Date/Time:** August 28, 2026, 20:57 UTC
- **Vector:** BGP (Border Gateway Protocol) Hijacking
- **Details:** Attackers falsely announced routes for a block of Hetzner-hosted IP addresses belonging to Softaculous, redirecting traffic meant for update systems and client portals to attacker-controlled infrastructure.
### Lateral Movement
- **Details:** Once the malicious update was installed on target VPS management servers, the attackers established persistence. Specific lateral movement within the customer networks is currently under investigation, though the presence of unauthorized SSH keys suggests intent to move throughout the hosting environment.
### Data Exfiltration/Impact
- **Impact:** Delivery of a malicious update package to a "handful" of servers.
- **Data Risk:** Potential compromise of payment information and credentials for users who accessed the Softaculous client/billing portal during the hijack window.
### Detection & Response
- **Detection:** Identified following the restoration of routing and reports of suspicious update behavior.
- **Response Actions:** Softaculous reported the fraudulent SSL certificate for revocation, released Virtualizor version 3.2.9.9 with a "Security Analyzer," and issued a public security advisory.
## Attack Methodology
- **Initial Access:** BGP Hijacking (Network Layer redirection).
- **Persistence:** Installation of a malicious systemd service: `java-jre-update.service`. Potential use of unauthorized SSH keys and scheduled tasks.
- **Defense Evasion:** Use of fraudulent SSL certificates to impersonate legitimate update servers; redirection of traffic meant that legitimate vendor logs recorded no activity.
- **Credential Access:** Possible theft of API credentials and payment data via the hijacked billing portal.
- **Impact:** Supply chain compromise resulting in unauthorized remote access to VPS management infrastructure.
## Impact Assessment
- **Financial:** Risk of credit card fraud for users who entered payment details during the incident.
- **Data Breach:** Potential compromise of administrative API credentials and client account passwords.
- **Operational:** Disruption to VPS providers; requirement for manual auditing and server hardening.
- **Reputational:** Significant impact on Softaculous/Virtualizor regarding the integrity of their legacy update infrastructure.
## Indicators of Compromise
- **Network Indicators:** Traffic redirected from legitimate Hetzner IP ranges to unauthorized BGP-announced routes.
- **File Indicators:** `/etc/systemd/system/java-jre-update.service`
- **Behavioral Indicators:** Unexpected outbound connections from Virtualizor management servers; new/unrecognized SSH keys in `authorized_keys`.
## Response Actions
- **Containment:** Routing was restored to legitimate paths; fraudulent certificates were submitted for revocation.
- **Eradication:** Users advised to delete the malicious service, rotate all API keys, and remove unauthorized accounts/keys.
- **Recovery:** Release of Virtualizor version 3.2.9.9 containing a Security Analyzer to help admins identify compromise.
## Lessons Learned
- **BGP Vulnerability:** Reliance on standard BGP without robust monitoring or RPKI (Resource Public Key Infrastructure) creates a significant single point of failure for software updates.
- **Trust in Updates:** The lack of cryptographic signing for update packages allowed the malicious payload to be accepted as legitimate.
- **Legacy Infrastructure Risks:** Legacy panels may lack the modern security controls needed to defend against sophisticated network-level attacks.
## Recommendations
- **Cryptographic Signing:** Implement mandatory code signing for all software updates (confirmed by vendor as a future action).
- **Network Security:** Implement RPKI to prevent unauthorized BGP prefix announcements.
- **Infrastructure Migration:** Move update infrastructure to providers with advanced DDoS and BGP hijacking protections.
- **Monitoring:** Deploy real-time BGP monitoring alerts to detect prefix hijacking within minutes.
- **Client Hardening:** Admins should implement IP whitelisting for API access and enforce Multi-Factor Authentication (MFA) on all client portal accounts.