Full Report
In other news: White House launches Project Watershed 250; Indian authorities take down Telegram doxing bot; Composer packages deliver iOS badness.
Analysis Summary
# Incident Report: BGP Hijack and Supply Chain Attack on Virtualizor
## Executive Summary
An unidentified threat actor successfully executed a Border Gateway Protocol (BGP) hijack targeting the IP space of Softaculous, the parent company of the Virtualizor web hosting management platform. By rerouting internet traffic for approximately 33 hours, the attackers delivered malicious software updates through a cloned website. The incident potentially compromised VPS management infrastructures and exposed the financial data of users who performed transactions during the window of the hijack.
## Incident Details
- **Discovery Date:** August 30/31, 2026
- **Incident Date:** August 28, 2026, to August 30, 2026
- **Affected Organization:** Softaculous / Virtualizor
- **Sector:** Information Technology / Web Hosting Management
- **Geography:** Global (Impacted Hetzner IP space)
## Timeline of Events
### Initial Access
- **Date/Time:** 20:57 UTC on 28 August 2026
- **Vector:** BGP Route Hijacking
- **Details:** AS62390 (NexonHost) began announcing an unauthorized /24 block (162.55.80[.]0/24) belonging to Hetzner. The announcement was more specific than the legitimate /16 block, causing global traffic to favor the attacker’s route.
### Lateral Movement
- **N/A:** The attack was a man-in-the-middle (MitM) positioning via routing manipulation rather than traditional internal lateral movement.
### Data Exfiltration/Impact
- **Malicious Updates:** The attackers hosted a clone of the Virtualizor website to distribute backdoored updates to VPS management servers.
- **Financial Data:** Potential theft of credit card and payment information for any users who made purchases on the site during the 33-hour window.
### Detection & Response
- **Detection:** The hijack was identified through network routing analysis (specifically noted by Doug Madory) showing a forged origin AS to bypass RPKI validation.
- **Response:** Virtualizor issued a security advisory to users; however, they noted a lack of visibility into the hijacked traffic logs as data resided on attacker infrastructure.
## Attack Methodology
- **Initial Access:** BGP Hijacking (AS Path Forgery).
- **Persistence:** Sustained 33-hour unauthorized route announcement.
- **Privilege Escalation:** Not applicable (Network layer manipulation).
- **Defense Evasion:** The attackers forged the origin AS (AS24940 - Hetzner) on the AS path to make the hijacked route appear RPKI-valid to automated filters.
- **Credential Access:** Potential harvesting of financial/payment credentials via a cloned website.
- **Discovery:** Selection of a specific /24 subnet to ensure "Longest Prefix Match" precedence in BGP routing.
- **Lateral Movement:** N/A.
- **Collection:** Interception of software update requests and payment traffic.
- **Exfiltration:** Redirection of legitimate user traffic to attacker-controlled servers.
- **Impact:** Supply chain compromise via malicious software distribution.
## Impact Assessment
- **Financial:** Unknown; potential loss from fraudulent transactions and remediation costs for hosting providers.
- **Data Breach:** Exposure of financial data and potential compromise of any VPS servers that installed the malicious update.
- **Operational:** Disruption of legitimate software update mechanisms for a major web hosting management platform.
- **Reputational:** Significant impact on Virtualizor/Softaculous due to the scale and sophistication of the routing attack.
## Indicators of Compromise
- **Network Indicators:**
- Hijacked Prefix: 162.55.80[.]0/24
- Malicious AS Path: ... 6204 62390 24940
- Legit AS Path: ... 24940
- **Behavioral Indicators:** Unexpected TLS certificate changes or domain redirects occurring between Aug 28 and Aug 30, 2026.
## Response Actions
- **Containment:** Restoration of legitimate BGP announcements to regain control of the IP space.
- **Eradication:** Virtualizor notified customers to check for and remove unauthorized updates.
- **Recovery:** Public disclosure and advisory issued via the Virtualizor blog.
## Lessons Learned
- **RPKI Limitations:** While RPKI is designed to prevent hijacks, sophisticated actors can forge AS paths to make unauthorized routes appear valid.
- **Monitoring:** The need for real-time BGP monitoring is critical for organizations managing sensitive software distribution infrastructure.
- **Visibility:** A lack of logging for hijacked traffic leaves a "blind spot" in post-incident forensics.
## Recommendations
- **Enhanced BGP Monitoring:** Implement services that alert on "more specific" prefix announcements and AS path changes.
- **Code Signing:** Ensure all software updates are cryptographically signed and that the client-side software verifies these signatures before installation.
- **Multi-CDN/Network Path Diversity:** Utilize diverse delivery paths to reduce the impact of a single BGP hijack.
- **User Notification:** Advise customers who made payments during the incident window to monitor for fraudulent activity and consider reissuing payment cards.