Softaculous, the developer of the Virtualizor VPS management software, has confirmed that a BGP hijacking attack allowed threat actors to deliver malicious updates to a limited number of Virtualizor installations. The incident occurred between August 28, 20:57 UTC, and August 30, 06:10 UTC, when attackers rerouted a block of Hetzner-hosted IP addresses associated with Softaculous's update infrastructure and client/billing portal.
Border Gateway Protocol (BGP) hijacking involves a network operator falsely announcing ownership of IP address routes belonging to another organization. When other networks accept these fraudulent routes, traffic intended for the legitimate owner can be diverted to the attacker. In this case, the hijacking enabled the threat actors to redirect traffic from Softaculous's software update systems.
Softaculous stated that a "small number of installations" received a malicious Virtualizor update package during the period their traffic was diverted. The company emphasized that this affected only a handful of servers, not the general Virtualizor user base. Due to the redirection of requests to the attacker's servers, Softaculous does not possess logs of the malicious update deliveries.
As a precautionary measure, Softaculous advises Virtualizor operators to check their systems for a service named `/etc/systemd/system/java-jre-update.service`. If this service is found, administrators should immediately rotate and restrict API credentials, and conduct a thorough audit of their systems for any unauthorized SSH keys, user accounts, scheduled tasks, or outbound network connections.
Furthermore, users who accessed the Softaculous client area or entered payment information during the incident window (August 28, 20:57 UTC to August 30, 06:10 UTC) are urged to reset their passwords, review their account activity for any suspicious actions, and monitor their credit card statements for unauthorized transactions.
Softaculous's investigation into the incident is ongoing, but there are currently no indications that any of its other products were impacted. The company confirmed that routing has been restored, the fraudulent certificate used by the attackers has been reported for revocation, and a new version of Virtualizor, version 3.2.9.9, was released on September 1. This new version includes a Security Analyzer tool integrated into the admin panel.
Looking ahead, Softaculous plans to implement cryptographic signing for all its software packages to enhance security and intends to migrate to an improved infrastructure.
