BGP Hijack Redirected Softaculous Updates, Delivering Malicious Virtualizor Package
Summary
Softaculous says BGP hijacking diverted update traffic from August 28–30, allowing a malicious Virtualizor package to reach a small number of installations. Routing is restored; the vendor recommends system checks and credential reviews.
Key points
- Softaculous says an attacker rerouted Hetzner-hosted IP addresses from August 28 at 20:57 UTC to August 30 at 06:10 UTC.
- The hijack diverted traffic from Softaculous update systems and its client and billing portal to malicious servers.
- A malicious Virtualizor update package reached a small number of installations that checked for updates during the diversion; Softaculous says the broader user base was not affected.
- Administrators are advised to check for /etc/systemd/system/java-jre-update.service and, if present, rotate and restrict API credentials and audit systems for unauthorized access or activity.
- Users who accessed the client area or entered payment information during the incident window should reset passwords, review account activity, and monitor card statements.
- Softaculous says routing has been restored and released Virtualizor 3.2.9.9 with a Security Analyzer. Its investigation is ongoing; the company plans cryptographic package signing.
Article Details
- Victim Organization
- Softaculous
- Incident Type
- BGP route hijacking used to redirect software update traffic and deliver a malicious Virtualizor update
- Affected Records
- A small number of Virtualizor installations, described as a handful of servers; exact count not disclosed.
- Operational Impact
- Traffic to Softaculous update systems and its client/billing portal was diverted. A malicious Virtualizor update reached a small number of installations. Softaculous said routing had been restored and reported no indications that its other products were affected.
- Claim Status
- confirmed