BGP hijack exposes Softaculous' missing update checks

A 33-hour BGP hijacking incident diverted traffic meant for Softaculous and Virtualizor systems, delivering malware to a small number of installations and forcing the vendor to urge customers to reset credentials and inspect their servers. The attack, which exploited weaknesses in both BGP route selection and the software update process, raises questions about the security of trust in internet infrastructure.

A route gone wrong

Beginning at 20:57 UTC on August 28, an unrelated network began announcing a block of Hetzner IP addresses used by Softaculous. This diverted some traffic intended for the vendor's systems to an attacker-controlled server. German hosting provider Hetzner is one of Softaculous's upstream infrastructure providers.

The affected addresses served a number of Softaculous systems, including Virtualizor's software update endpoint and Softaculous's client and billing site.

How the hijack worked

The attacker pulled off the hijack by announcing a more specific IP address range than Hetzner normally advertised. Under standard BGP route selection, the more specific route took precedence wherever it was accepted. According to Softaculous, the attacker also secured a valid TLS certificate from Let's Encrypt because the certificate authority's automated domain-ownership validation was routed through the hijack too.

This allowed affected connections to reach the attacker's server without triggering the certificate warnings that might otherwise have alerted users. The combination of a more-specific route and a valid certificate made the attack particularly stealthy.

A flapping, two-wave incident

According to the vendor's timeline, the unauthorized route was initially "accepted by essentially every internet vantage point that receives it," although it flapped repeatedly rather than remaining continuously available. Softaculous reported the issues to Hetzner at around 08:50 UTC on August 29.

The hosting provider began directly announcing the same, more-specific address range, cutting the observed diversion to almost zero for roughly 11 hours. However, the unauthorized announcement returned at around 20:00 UTC and was again widely accepted, beginning a second wave that lasted roughly ten hours. The route was withdrawn between 05:50 and 06:10 UTC on August 30, after which normal routing was restored globally.

High exposure for affected servers

While either wave was active, Softaculous estimates that a given server had roughly a 72 percent chance of being on a network that routed the affected address range through the attacker. The figure is based on the proportion of RIPE routing collector peers carrying the hijacked route, not the volume of traffic intercepted, the vendor said.

• 33-hour total duration of the BGP hijack
• Roughly 11 hours of near-zero diversion between the two waves
• Approximately 72 percent chance a given server was on a network routing traffic through the attacker during active waves

Credentials and payment data at risk

Anyone who logged into the Softaculous client area during the incident window is advised to reset that password immediately, as well as anywhere else it was reused. Customers who entered card details during the same window should also review their statements.

Softaculous said it does not process cards on its own servers and instead uses payment gateways, but an affected session may have been diverted before reaching them.

Malicious update package delivered

More seriously, the vendor confirmed that a malicious Virtualizor update package was delivered to a handful of installations whose update checks passed through the attacker's server. "Our product update clients did not yet cryptographically verify update packages, so a modified package would not have been rejected on that basis."

Because those downloads never reached its own logs, Softaculous said it "cannot produce a definitive list" of affected installations. It is therefore telling every Virtualizor operator to treat their server as in scope for checks – not necessarily as compromised.

Indicators of compromise

Softaculous did not describe the malware's capabilities, but identified a systemd unit at /etc/systemd/system/java-jre-update.service as an indicator of compromise. Operators that find it are advised not to delete it immediately, but to contact the vendor so evidence can be preserved.

The vendor has not identified malicious packages targeting Backuply, Softaculous, SitePad, Webuzo, or its other products, although its investigation continues.

What operators should do now

Virtualizor operators should rotate and restrict their API credentials, check for unknown SSH keys and accounts, inspect scheduled tasks and outbound connections, and regenerate client-area API keys. Softaculous is also invalidating client-area sessions created during the incident window.

Softaculous did not disclose how many customers downloaded the malicious update or may have handed credentials to the attacker. It said only that the confirmed infections amounted to "a handful of servers rather than the general Virtualizor user base."

Why it matters

This incident underscores the fragility of trust in core internet protocols. The BGP hijack was possible because of the protocol's inherent trust model, and the lack of cryptographic verification of update packages turned a routing anomaly into a potential supply-chain attack.

For hosting providers and software vendors, this could mean that relying on standard BGP hygiene and unverified update channels is no longer enough. The attack also suggests that even a brief window of traffic diversion can have significant consequences, especially when certificate authorities and update mechanisms are involved. This could push more organizations to adopt RPKI and other route-origin validation measures, as well as code-signing for software updates.