Threat actors conducted a BGP hijacking attack targeting the update infrastructure of Virtualizor, a popular VPS management software. By hijacking BGP routing, attackers redirected update requests intended for legitimate Virtualizor servers to malicious servers under their control. This allowed them to push trojanized or malicious software updates to unsuspecting Virtualizor users. The attack represents a sophisticated supply chain compromise leveraging BGP routing manipulation, a technique that can affect large numbers of users simultaneously. BGP hijacking at this level requires significant resources or access to BGP routing infrastructure. Users of Virtualizor who updated their software during the attack window may have received and installed malicious code. The incident highlights the risks of software update mechanisms that lack strong cryptographic verification and the dangers of BGP as an inherently trust-based protocol. Organizations using Virtualizor should audit their systems for signs of compromise and verify the integrity of installed software.
Between 20:57 UTC on August 28 and 06:10 UTC on August 30, attackers conducted a BGP (Border Gateway Protocol) hijacking attack targeting a block of Hetzner-hosted IP addresses used by Softaculous for its Virtualizor VPS management software update infrastructure. By falsely announcing routes to those IP addresses, the threat actors diverted update traffic and client/billing portal traffic to malicious servers. This allowed them to serve a trojanized Virtualizor update package to a small number of installations that checked for updates during the hijack window. A fraudulent TLS certificate was also used to facilitate the attack. The malicious update installed a systemd service named 'java-jre-update.service' as a persistence mechanism. Softaculous does not have logs of affected systems because the requests were redirected to attacker-controlled infrastructure.
1. Check for the malicious systemd service at /etc/systemd/system/java-jre-update.service and remove it if found. 2. Rotate and restrict all API credentials. 3. Audit systems for unauthorized SSH keys, new user accounts, scheduled tasks, and suspicious outbound connections. 4. Users who accessed the Softaculous client area or entered payment information between August 28 20:57 UTC and August 30 06:10 UTC should reset their passwords, review account activity, and monitor card statements for unauthorized charges. 5. Upgrade Virtualizor to version 3.2.9.9, which includes a Security Analyzer tool in the admin panel. 6. Monitor for any unauthorized changes to update infrastructure or BGP routing announcements. Softaculous plans to implement cryptographic signing for all software packages and migrate to more secure infrastructure going forward.
/etc/systemd/system/java-jre-update.service
