A Virtualizor BGP hijacking attack allowed hackers to redirect software update traffic and send a malicious update package to a small number of VPS management servers.
The incident affected update infrastructure run by Softaculous, the company behind Virtualizor. The vendor says the attack occurred between August 28 and August 30.
Attackers rerouted Virtualizor update traffic
Virtualizor is a web control panel that hosting providers use to create, sell and manage virtual private servers.
Softaculous said an attacker hijacked Border Gateway Protocol routes for a block of Hetzner-hosted IP addresses. The fraudulent routing announcement redirected traffic intended for the company’s update systems and customer portal.
In a BGP hijacking attack, a network falsely advertises that it can route traffic for IP addresses owned by another organisation. Networks that accept the announcement may then send traffic to the attacker instead of its real destination.
The attacker used this access to redirect update requests to malicious servers.
Only a handful of servers received the update
Softaculous confirmed that malicious Virtualizor update packages reached a small number of installations that checked for updates during the attack window.
The company said the incident affected only a handful of servers, not the wider Virtualizor user base. Because the attacker intercepted the traffic, Softaculous does not have complete logs of affected systems.
Administrators should check for the following service file:
/etc/systemd/system/java-jre-update.service
If it exists, operators should rotate and limit API credentials. They should also review their systems for unauthorised SSH keys, user accounts, scheduled tasks and unusual outbound connections.
Softaculous releases security update
People who logged in to the Softaculous client area or entered payment details during the incident window should reset their passwords, check account activity and monitor card statements.
Softaculous said it has restored normal routing and reported the fraudulent certificate for revocation. Its investigation remains ongoing, although the company has not found evidence that the attack affected other products.
On September 1, the company released Virtualizor version 3.2.9.9. The release adds a Security Analyzer tool to the administration panel.
Softaculous also plans to introduce cryptographic signing for all software packages and move its services to more secure infrastructure.
0 responses to “Virtualizor BGP Hijacking Delivers Malicious Software Update”