On the night of August 28, 2024, a sophisticated attack unfolded against the update infrastructure of Virtualizor, a widely used web control panel for managing virtual private servers. By hijacking the Border Gateway Protocol (BGP) routing for a block of IP addresses hosted at Hetzner, an unknown threat actor redirected traffic from Softaculous software update systems and the client billing portal to malicious servers. The result was a malicious update package delivered to a small number of Virtualizor installations—a stark reminder of how vulnerabilities at the internet routing layer can bypass even robust software security practices.
Virtualizor, developed by Softaculous, is a legacy control panel that hosting providers rely on to create, sell, and manage VPS instances. Its user base includes thousands of hosting companies, many of which operate mission-critical infrastructure. The attack leveraged a BGP hijacking technique, a form of route manipulation where a network operator falsely announces ownership of IP addresses that belong to another organization. When other networks accept these fraudulent routes, traffic destined for the legitimate IPs is rerouted to the attacker, who can then intercept, modify, or redirect it.
Between 20:57 UTC on August 28 and 06:10 UTC on August 30, the attacker controlled a block of IP addresses that Softaculous used for its update servers and the Softaculous client area. During this window, any Virtualizor server that checked for updates had its request diverted to the attacker’s infrastructure. The vendor confirmed that a malicious update package was delivered to “a handful of servers” rather than the general user base. Because the traffic was redirected away from Softaculous’s own logs, the company has no direct record of which systems were affected.
The Mechanism of the BGP Hijacking Attack on Softaculous
BGP is the postal service of the internet. It determines how data packets travel from one network to another by exchanging routing information between autonomous systems (AS). When a network operator announces a route to an IP prefix, other networks update their routing tables accordingly. In a BGP hijacking, an attacker announces a more specific or more attractive route to a prefix they do not own. If the announcement is accepted by neighboring networks, traffic destined for the legitimate IPs flows to the attacker instead.
In this case, the attacker targeted a block of IP addresses hosted by Hetzner, a German cloud provider. Softaculous used these IPs for its update servers and the client/billing portal at softaculous.comcodecodecodecodecode. By hijacking this block, the attacker could receive HTTPS requests intended for these servers. Because the attack occurred at the network layer, even encrypted connections could be intercepted—provided the attacker had a valid certificate or could present a fraudulent one to clients.
Softaculous has since confirmed that a fraudulent certificate was used during the attack and has reported it for revocation. The attacker likely used this certificate to sign the malicious update, making it appear legitimate to the Virtualizor update process. For users who accessed the client area or entered payment information during the incident window, the attacker could have captured credentials, session tokens, or financial data.
What Is a Malicious Virtualizor Update and How to Detect It
A malicious update is a software patch that appears to be a legitimate release but contains unauthorized code. In this attack, the update was delivered to a small number of Virtualizor installations that checked for updates while their traffic was being diverted. The vendor has not publicly disclosed the specific payload of the malicious update, but the presence of a systemd service file named /etc/systemd/system/java-jre-update.servicecodecodecodecodecode is a strong indicator of compromise.
This service file likely establishes persistence on the affected server, allowing the attacker to maintain access, execute commands, or exfiltrate data. Administrators should check for this file immediately. If found, the immediate steps include:
- Rotating all API credentials used by the Virtualizor installation.
- Restricting API access to only necessary IP ranges.
- Auditing the system for unauthorized SSH keys, user accounts, scheduled tasks, and outbound network connections.
- Reviewing system logs for any unusual activity during the attack window (August 28–30).
Additionally, any user who accessed the Softaculous client area or entered payment information during that time should reset their passwords, review account activity for unauthorized changes, and monitor credit card statements for fraudulent transactions.
Softaculous has released Virtualizor version 3.2.9.9, which includes a new “Security Analyzer” tool in the admin panel. This tool can help identify common indicators of compromise, though it is not a substitute for a thorough manual audit.
Why BGP Hijacking Is a Growing Threat to Software Supply Chains
BGP hijacking is not new, but its use in software supply chain attacks is increasingly common. The attack surface is broad: any organization that relies on BGP to announce its own IP prefixes—or that uses third-party hosting—can be targeted. The attack on Softaculous is particularly concerning because it targeted update infrastructure, a critical component of the software supply chain. If an attacker can deliver a malicious update to even a handful of servers, the potential for lateral movement, data theft, or ransomware deployment is significant.
This incident mirrors other high-profile BGP hijacking attacks, such as the 2018 attack on Amazon’s DNS (Route53) that redirected traffic to a malicious cryptocurrency wallet, and the 2021 attack on a Chinese ISP that redirected traffic from dozens of organizations. However, the Softaculous attack is notable for its precision: the attacker targeted a specific IP block used by a single vendor, rather than a broad swath of the internet.
For hosting providers and other organizations that manage Virtualizor, the attack underscores the need for defense in depth. Even if the update server is compromised, cryptographic signing of software packages can prevent the installation of untrusted code. Softaculous has announced plans to implement cryptographic signing for all software packages going forward, a move that should have been standard practice years ago.
How Does a BGP Hijacking Attack Work? A Technical Explanation
BGP hijacking exploits the trust-based nature of internet routing. When a network operator (the attacker) announces a route to an IP prefix that they do not own, other networks may accept this announcement if it is more specific or has a shorter path. For example, if the legitimate owner of the prefix 192.0.2.0/24 announces it via a path length of 10 hops, and the attacker announces 192.0.2.0/24 with a path length of 5 hops, many networks will prefer the attacker’s route.
There are several types of BGP hijacking:
- Prefix hijacking: The attacker announces a prefix they do not own, either in whole or in part.
- Subprefix hijacking: The attacker announces a more specific prefix (e.g., 192.0.2.0/25 instead of 192.0.2.0/24), which is typically preferred by routers.
- Path manipulation: The attacker alters the AS path to make their route appear more attractive.
In the Softaculous attack, the hijacker announced a block of IP addresses that were part of Hetzner’s range. Hetzner is a reputable provider, but the attack succeeded because the fraudulent announcement was accepted by some upstream networks. Once traffic was redirected, the attacker could intercept HTTPS requests and present a fraudulent certificate. The attack lasted approximately 33 hours, from 20:57 UTC on August 28 to 06:10 UTC on August 30.
Softaculous has since restored routing and reported the fraudulent certificate. The company is also working on migrating to better infrastructure, likely involving more robust BGP monitoring and multi-homed routing to reduce the risk of future hijacks.
Who Was Affected? The Scope of the Attack
Softaculous has stated that the malicious update was delivered to “a small number of installations” and “a handful of servers” rather than the general user base. This suggests that the attack was not widespread, but it is noteworthy that the vendor does not have logs of the redirected traffic. Therefore, the exact number of affected installations is unknown. The company recommends that all Virtualizor operators check for the indicator of compromise—the /etc/systemd/system/java-jre-update.servicecodecodecodecodecode file—regardless of whether they believe they were targeted.
Users who accessed the Softaculous client area (billing portal) during the incident window are also at risk. The attacker could have captured login credentials, session tokens, or payment card information. Softaculous has advised these users to reset passwords and monitor financial accounts.
It is important to note that Softaculous’s other products—including Softaculous itself (the auto-installer) and other control panels—showed no signs of compromise. The investigation is ongoing, but the vendor has found no evidence that the attack extended beyond Virtualizor update infrastructure and the client area.
Immediate Remediation Steps for Virtualizor Administrators
If you manage a Virtualizor installation, the following steps are critical:
- Check for the malicious service file: Run
ls -la /etc/systemd/system/java-jre-update.servicecodecodecodecodecode. If the file exists, the server is likely compromised. Do not delete the file immediately; preserve it for forensic analysis. - Rotate all API credentials: This includes any API keys used by Virtualizor to communicate with external services, as well as any credentials stored in the control panel.
- Audit system accounts: Look for unauthorized SSH keys in
/root/.ssh/authorized_keyscodecodecodecodecode and other user directories. Check for new user accounts created during the attack window. - Review scheduled tasks: Examine crontab entries and systemd timers for any suspicious jobs.
- Monitor outbound connections: Use tools like
netstatcodecodecodecodecode orsscodecodecodecodecode to identify connections to unknown IP addresses. Cross-reference these with known threat intelligence feeds. - Update to Virtualizor 3.2.9.9: This version includes the Security Analyzer tool, which can help identify common indicators of compromise. However, do not rely solely on this tool; manual verification is essential.
For billing portal users: If you accessed the Softaculous client area between August 28 and August 30, change your password immediately. Also, review your account activity for any unauthorized changes, such as altered payment methods or new subscriptions. Monitor your credit card statements for unfamiliar charges.
How Can Organizations Prevent BGP Hijacking Attacks?
Preventing BGP hijacking requires a multi-layered approach. The internet community has developed several technical and procedural measures:
- Resource Public Key Infrastructure (RPKI): RPKI allows network operators to cryptographically sign their route announcements. Other networks can then validate that a route originates from the legitimate owner. Adoption of RPKI is growing, but it is not yet universal.
- BGP monitoring and alerting: Services like BGPmon, Cloudflare’s BGP Route Leak Detection, or self-hosted tools can alert administrators when unexpected route announcements occur for their IP prefixes.
- Multi-homed routing: Using multiple upstream providers with diverse routing policies can reduce the likelihood of a single hijack affecting all traffic.
- Cryptographic signing of software updates: This is a critical defense for software vendors. Even if an attacker hijacks the update server, they cannot sign a malicious update without the private key. Softaculous has announced plans to implement this.
- Network segmentation and monitoring: For organizations that host their own update infrastructure, segmenting these servers from other systems and monitoring for unusual traffic patterns can help detect hijacks early.
While these measures are effective, BGP hijacking remains a difficult problem to solve due to the distributed and trust-based nature of the protocol. The Softaculous attack is a case study in how even a temporary hijack can have serious consequences.
Softaculous’s Response and Future Plans
Softaculous has been transparent about the incident, issuing a public notice on the Virtualizor blog and providing detailed instructions for affected users. The company has taken several actions:
- Restored proper BGP routing for the affected IP block.
- Reported the fraudulent certificate to the relevant certificate authority for revocation.
- Released Virtualizor version 3.2.9.9 with a Security Analyzer tool.
- Announced plans to implement cryptographic signing for all software packages.
- Committed to migrating to better infrastructure, which likely includes more robust BGP protections and possibly a content delivery network (CDN) for updates.
The investigation is still underway, and the vendor has not disclosed whether the attacker gained access to the Softaculous code signing keys or the Virtualizor source code repository. If the keys were compromised, the impact could be broader. However, as of now, no other Softaculous products have been affected.
The company’s decision to implement cryptographic signing is a positive step. Many software vendors, including major operating system distributors, have used signed packages for years. For a control panel that manages virtual private servers—a product that inherently requires high trust—the absence of such signing was a vulnerability waiting to be exploited.
Implications for the Hosting Industry
This attack is a wake-up call for hosting providers, many of whom rely on third-party control panels like Virtualizor, cPanel, Plesk, and others. The incident demonstrates that even if your own infrastructure is secure, a compromise in the software supply chain can undermine your security posture. The attack was not a generic exploit; it required a targeted BGP hijack against a specific vendor. But the effect on the handful of affected servers could be severe: a malicious update could include backdoors, ransomware, or data exfiltration tools.
Hosting providers should consider the following:
- Evaluate the security practices of their control panel vendors. Do they use cryptographic signing? Do they have BGP monitoring? How quickly do they respond to incidents?
- Implement network monitoring to detect unusual traffic patterns, especially during update checks.
- Use sandboxed environments for update downloads, such as verifying checksums or signatures before applying updates.
- Maintain offline backups and a disaster recovery plan that accounts for supply chain attacks.
The broader industry trend toward zero-trust architectures also applies here. Trust no network, no server, and no update until it is verified. The Softaculous incident is a reminder that the internet’s routing layer is not invulnerable, and that software updates—the lifeblood of security patching—can themselves become attack vectors.
Understanding the Timeline: The Attack Window in Detail
The attack began at 20:57 UTC on August 28 and lasted until 06:10 UTC on August 30. This window of approximately 33 hours aligns with a typical weekend period, which may have been chosen to minimize the chance of immediate detection. The vendor likely noticed the routing anomaly during the incident or shortly after, as the attack was disclosed in early September.
During this window, any Virtualizor server that checked for updates would have been redirected to the attacker’s infrastructure. The malicious update was delivered only to those servers that checked during the hijack. The attacker would have had to act quickly to serve the malicious payload, suggesting a well-prepared operation. The use of a fraudulent certificate indicates that the attacker either obtained a certificate from a compromised CA or generated one that was accepted by the client software.
Softaculous has not confirmed whether the attacker targeted specific high-value installations or simply cast a wide net. The fact that only a handful of servers were affected could mean that the attacker limited the scope to avoid detection, or that the majority of Virtualizor installations did not check for updates during that time.
What Can Users Do Now?
For current Virtualizor users, the immediate priority is to check for the indicator of compromise and follow the remediation steps outlined above. Even if you have already updated to version 3.2.9.9, you should still perform a manual audit, as the Security Analyzer tool may not catch all sophisticated backdoors.
Users who accessed the Softaculous client area during the attack window should also take proactive steps. Change your password, enable two-factor authentication if not already done, and review your account for any unauthorized changes. Monitor your credit card statements for at least the next few months, as fraudsters often delay using stolen card data.
Long-term, consider diversifying your control panel portfolio. If you run critical infrastructure, having a secondary control panel or management method can reduce dependence on a single vendor. Also, consider using a separate update repository or a proxy that caches updates and verifies signatures before distribution.
The Broader Context: Supply Chain Security in the Age of BGP Hijacks
The Softaculous attack is part of a rising trend of supply chain attacks that target the software update mechanism. In 2020, the SolarWinds attack compromised the Orion software build system, leading to a massive breach of government and corporate networks. In 2022, the Kaseya VSA ransomware attack used a malicious update to compromise hundreds of managed service providers. BGP hijacking adds a new dimension: attackers can compromise the delivery channel even without breaking into the vendor’s build system.
This attack is also notable for its combination of network-layer and application-layer techniques. The BGP hijack enabled the attacker to intercept traffic, but the malicious update had to be crafted to exploit the update mechanism. The attacker likely reverse-engineered the Virtualizor update process to create a payload that would be installed without detection.
Softaculous’s decision to implement cryptographic signing is a direct response to this vulnerability. With proper signing, even if traffic is hijacked, the client would reject an unsigned or improperly signed update. This is a standard practice that should be universal across all software vendors. The fact that it took a BGP hijacking attack to prompt this change is a telling comment on the state of software security.
What Is the Future of BGP Security?
BGP was designed in the 1980s for a smaller, more trusted internet. Today, it remains one of the least secure protocols in widespread use. Efforts to improve BGP security, such as RPKI and BGPsec, have been slow to adopt due to the complexity of deployment and the lack of economic incentives. The Softaculous attack is another data point that argues for faster adoption.
Internet service providers, cloud providers, and large enterprises should all implement RPKI for their prefixes. Governments and regulators may also need to step in, as they have with other critical infrastructure security. The US Cybersecurity and Infrastructure Security Agency (CISA) has already issued guidance on BGP security, but it remains voluntary.
For software vendors, the lesson is clear: treat your update infrastructure as a critical asset. Use CDNs, multiple redundant servers, and cryptographic signing. Monitor for BGP hijacks and have a response plan ready. The cost of prevention is far less than the cost of a breach.
The Virtualizor BGP hijacking attack will likely be studied as a case study in supply chain security for years to come. It demonstrates that no software is too niche to be targeted, and that the internet’s fundamental routing infrastructure remains a weak link. The affected users—the handful of Virtualizor operators—now face the difficult task of remediation and forensic analysis. For everyone else, the attack is a sobering reminder that security is a chain, and a broken link at the network layer can compromise everything above it.
