Hackers push malicious Virtualizor update in BGP hijacking attack

Attackers exploited a BGP hijacking vulnerability to reroute traffic intended for Softaculous's Virtualizor update servers to attacker-controlled infrastructure. This allowed delivery of malicious update packages to a limited number of Virtualizor VPS management software installations. The hijacking affected IP addresses hosted by Hetzner and lasted approximately 33 hours. Softaculous lacks logs of the malicious update requests due to traffic diversion. The vendor has restored legitimate routing, revoked fraudulent certificates, and released Virtualizor version 3.2.9.9 with a Security Analyzer tool. They plan to implement cryptographic signing for software packages and improve infrastructure security. Administrators are advised to audit for malicious services, rotate credentials, and monitor for unauthorized access.

A small number of Virtualizor installations received malicious update packages, potentially compromising those servers. The attack could have allowed unauthorized access or control over affected VPS management systems. Users who accessed the Softaculous client area or entered payment information during the incident window may have had their credentials or payment data exposed. However, the overall impact is limited as only a handful of servers were affected, and no other Softaculous products were impacted according to the vendor.

Softaculous has restored legitimate routing and revoked fraudulent certificates. A new Virtualizor version 3.2.9.9 with security enhancements is available. Administrators should check for the presence of the /etc/systemd/system/java-jre-update.service, rotate and restrict API credentials, audit systems for unauthorized SSH keys, accounts, scheduled tasks, and outbound connections. Users who accessed the client area or entered payment information during the incident should reset passwords, review account activity, and monitor payment statements. The vendor plans to implement cryptographic signing for all software packages and migrate to more secure infrastructure. Patch status is confirmed with the release of version 3.2.9.9.