BGP Hijack Diverts Softaculous Traffic to Steal Credentials and Deploy Malware

A sophisticated BGP hijacking incident diverted traffic from Softaculous and Virtualizor systems to an attacker-controlled server, resulting in credential theft and malware distribution. The attack exploited fundamental weaknesses in internet routing and software update verification to deceive users and systems alike.

The hijack began at 20:57 UTC on August 28 and lasted until approximately 06:10 UTC on August 30. The attacker diverted traffic by announcing a more specific IP range (162.55.80.0/24) than the upstream provider, Hetzner. By exploiting this hijacked path for domain validation, the attacker successfully obtained a valid Let's Encrypt TLS certificate. This critical step ensured that users connecting to the diverted services saw no browser warnings, allowing the attacker to seamlessly intercept traffic and steal user credentials.

Infrastructure Vulnerabilities

Softaculous provides essential software for the web hosting industry, including the Virtualizor control panel, which providers use to manage virtual private servers (VPS). The targeted infrastructure was hosted by the German provider Hetzner. The attack demonstrated how a more specific route announcement can override legitimate routing paths, effectively "kidnapping" traffic before it reaches the intended destination.

The Impact of Unverified Updates

Beyond credential theft, the attacker delivered a malicious update package to a small number of Virtualizor installations. This was possible because the update clients lacked cryptographic verification. Softaculous acknowledged the flaw, stating, "Our product update clients did not yet cryptographically verify update packages, so a modified package would not have been rejected on that basis."

This lack of verification turned a routing error into a direct compromise of server integrity. Security researchers have identified a specific indicator of compromise (IoC) for the deployed malware: a systemd unit located at `/etc/systemd/system/java-jre-update.service`.

Industry Implications

This incident underscores a persistent and critical vulnerability in the Border Gateway Protocol (BGP) that governs how data travels across the internet. When combined with the ability to automate TLS certificate issuance, BGP hijacks can bypass the primary visual security cues that users rely on to identify man-in-the-middle attacks.

Furthermore, the event serves as a stark reminder for software vendors that relying on HTTPS alone is insufficient for update delivery. Without end-to-end cryptographic signing of the packages themselves, any compromise of the delivery path—whether through DNS poisoning or BGP hijacking—allows an attacker to push arbitrary code to a global install base.

Next Steps for Administrators

System administrators using Virtualizor should check their systems for the aforementioned systemd unit to determine if they were affected. The industry continues to push for wider adoption of Resource Public Key Infrastructure (RPKI) to prevent such route leaks and hijacks, though adoption remains uneven across global providers.