Hackers executed a Border Gateway Protocol (BGP) hijack to divert traffic intended for Softaculous, the distributor of the Virtualizor control panel software. The diverted traffic was used to deliver a malicious Virtualizor package to targeted installations. At least one hosting provider confirmed that 5 out of 34 checked Virtualizor hypervisors were compromised at the root level. The attack established persistent root access on affected systems. The incident window began approximately August 28 at 20:57. This represents a sophisticated supply chain attack combining network-level manipulation with software update poisoning. The attack targeted server virtualization infrastructure, potentially exposing all virtual machines hosted on compromised hypervisors. The use of BGP hijacking indicates a highly capable threat actor with access to routing infrastructure.
Attackers performed a BGP hijack targeting the IP prefix 162.55.80.0/24 to divert Softaculous update traffic to an attacker-controlled server. The diversion window ran from August 28, 2026 at 20:57:30 UTC to August 30, 2026 at 06:10 UTC. During this window, the attacker obtained a valid Let's Encrypt TLS certificate, preventing any certificate warnings for victims. Virtualizor's update client lacked cryptographic package verification, so it accepted the tampered package without rejection. The malicious package injected code into three legitimate Virtualizor core files: globals.php, _universal.php, and zzvirtservice. The injected code added an attacker-controlled SSH key to the root account, installed Java 17 if absent, downloaded a Java payload (widdow.jar) from cdn[.]nerat[.]cc, and executed it as root. The payload established persistence via a systemd service (java-jre-update.service), created an unauthorized user account named 'proxyuser', and connected back to C2 infrastructure. A successful password-based SSH login to the proxyuser account was observed from IP 193.32.127[.]248. AlbaHost confirmed 5 of its 34 Virtualizor hypervisor nodes were compromised. Client-area sessions and payment-entry traffic during the diversion window may have reached the attacker-operated server.
1. Check for the presence of /etc/systemd/system/java-jre-update.service; if found, preserve evidence and contact Virtualizor support before remediating. 2. Rotate all Virtualizor API keys, restrict API access to trusted IP addresses only, and remove any unrecognized API keys. 3. Audit SSH authorized_keys for unknown entries, check for new/unexpected user accounts (especially 'proxyuser'), review cron jobs and scheduled tasks, and audit unexpected outbound network connections. Restrict SSH to trusted IP addresses. 4. Run the official Virtualizor security scanner from https://files.virtualizor.com/security/virtualizor_security_scan.sh (verify SHA-256: 73e74402b3a61c7bab289fc11347bd54c7fcdc2fa2e410f4c3de9d6cd7377d48 before executing). 5. Upgrade to Virtualizor 3.2.9.9 (Patch 9) which includes the Security Analyzer. 6. For confirmed compromised hosts, perform a full clean rebuild as the only reliable long-term remediation; restore altered core Virtualizor files from known-good content or reinstall. 7. Client-area users who logged in or entered payment details during August 28–30, 2026: reset passwords, change them anywhere reused, review account activity, and review card statements. Regenerate Client Center API keys. 8. Operators of other Softaculous products (Webuzo, Backuply, SitePad, etc.) that performed update checks during the incident window should audit those servers. 9. Block the identified C2 domains (cdn[.]nerat[.]cc, connect[.]ne-rat[.]xyz) and IP addresses (193.32.127[.]248, 31.77.220[.]138) at the network perimeter. 10. Advocate for and await Virtualizor's implementation of cryptographic package signing for future update verification.
/etc/systemd/system/java-jre-update.service, /usr/lib/jvm/.cache/jre-runtime.dat, b81a4e1fab9fc4e404d57224fe71e2c143aa93942bd46998789bdc944a7870c7, /usr/lib/jvm/.cache/.installed, /tmp/widdow.jar, /usr/local/virtualizor/globals.php, /usr/local/virtualizor/_universal.php, /usr/local/virtualizor/zzvirtservice, cdn[.]nerat[.]cc/installer/widdow.jar, connect[.]ne-rat[.]xyz, jre-runtime.dat, cdn[.]nerat[.]cc, connect[.]ne-rat[.]xyz, AAAAC3NzaC1lZDI1NTE5AAAAIP13pPAm5jmInLQYD3XNb3HwrW4cAKDcphoT4kSKrnte, proxyuser, 193.32.127[.]248, 31.77.220[.]138:2025, /tmp/.vz_svc_done, SHA256:YQmy1hKF1h5cdJLxlZ5EScNoxe/UDWahjsWuQw2ERi8, 73e74402b3a61c7bab289fc11347bd54c7fcdc2fa2e410f4c3de9d6cd7377d48
