BGP Hijack Delivers Malicious Virtualizor Update via Softaculous Traffic Diversion
Attackers hijacked BGP routes for Softaculous, diverting traffic to deliver a malicious Virtualizor update with a valid TLS certificate, potentially enabling root-level code execution on hypervisor servers.
Attackers recently hijacked Border Gateway Protocol (BGP) routes associated with Softaculous, a popular software auto-installer, to distribute a malicious update for Virtualizor, a server management platform. The incident, which occurred between August 28 and August 30, 2026, targeted hypervisor servers managed by Virtualizor, a product used by hosting providers to manage virtual private servers (VPS) on various platforms including KVM, Xen, and Proxmox. A compromise at this level could have far-reaching implications, as a single master Virtualizor instance can control hundreds of virtualization servers.
The attackers achieved the hijack by announcing a more specific BGP prefix (AS62390 announcing 162.55.80.0/24) than the legitimate route normally advertised by Hetzner (AS24940) for its IP block used by Softaculous's update and billing systems. This more specific announcement effectively overrode Hetzner's legitimate routes across the internet, directing traffic intended for Softaculous to the attacker-controlled infrastructure. The hijack was significant, with RIPE RIS data indicating that at its peak, approximately 72 percent of collector peers were routing traffic through the malicious AS62390.
Compounding the sophistication of the attack, the attackers were able to obtain a valid TLS certificate for the domains virtualizor.com, api.virtualizor.com, and files.virtualizor.com. This was likely achieved by diverting Let's Encrypt validation requests to their controlled servers. The presence of a valid TLS certificate meant that client connections to Virtualizor's update servers, as well as its client area, would not trigger any security warnings, making the malicious activity harder to detect. Users accessing the Softaculous client area during the diversion window may have inadvertently communicated with the attacker.
Virtualizor confirmed that its update clients lacked cryptographic verification for downloaded packages. This critical oversight meant that the combination of a BGP hijack and a valid TLS certificate was sufficient for attackers to deliver and execute malicious code with root privileges on affected hypervisor servers. While the attackers' server did not appear in vendor logs, the vendor stated that every Virtualizor host should be considered potentially compromised. The intermittent nature of the diversion, due to approximately 10,600 route withdrawals, limited the number of update checks that successfully reached the attacker's server.
The immediate impact on customer VPS instances is not yet confirmed, but a root-compromised hypervisor poses a significant risk to all guest virtual machines hosted on that server. The attackers' ultimate goal and the full extent of any data exfiltration or system compromise remain under investigation. No malicious packages have been identified for other associated products like Webuzo, Backuply, or SitePad.
As an indicator of compromise, Virtualizor has identified the presence of /etc/systemd/system/java-jre-update.service on affected systems. The vendor advises customers to treat this file with caution and contact them directly rather than attempting to remove it. Recommended mitigation steps include rotating API keys, restricting SSH and API access to trusted IP addresses, and diligently checking for any unauthorized user accounts, API keys, or scheduled tasks.
Users who accessed the Softaculous client area during the attack window are urged to reset their passwords and regenerate any associated API keys as a precautionary measure. The BGP routes were reportedly restored to normal by August 30, 2026, with no further diversions detected after 06:10 UTC on that day. This incident underscores the critical importance of robust BGP security and the need for software update mechanisms to incorporate strong cryptographic verification to prevent such supply-chain attacks.