BGP hijack pushes malware via a 256-IP range

For a little over a day last weekend, a slice of the Internet's address space was quietly under the control of attackers who used it to push malicious software updates to real systems. The incident, first disclosed by Softaculous, is a reminder that even as routing security improves, a single configuration lapse can undo it.

Lax routing setup blamed

Softaculous reported that attackers carried out a supply-chain attack that took advantage of a weak routing security setup at Hetzner Online, a hosting provider, and a failure to follow standard software validation practices. The attackers performed a BGP hijacking to take control over IP addresses assigned to Softaculous, a UAE-based maker of a platform for installing and managing web software and the developer of Virtualizor, a management platform for virtualized environments.

Softaculous said the hijackers manipulated the address space to push malware disguised as software updates. “During the incident window, a Virtualizor installation whose traffic was diverted could have received a malicious update package from the attacker’s server,” Softaculous warned Monday. “Our product update clients did not yet cryptographically verify update packages, so a modified package would not have been rejected on that basis. We believe only a small number of servers were actually affected, but we cannot produce a definitive list, so please treat every Virtualizor server as in scope for the checks below.”

The company urged all Virtualizor users to inspect their systems for signs of compromise, though it said it could not provide a definitive list of affected servers.

Routing flaws let hijack repeat

Hetzner Online's loose configuration allowed the hijack to intermittently misdirect traffic over two spans in a 33-hour window, according to a warning published by Softaculous. Hetzner Online reclaimed the address space 12 hours after the hijacking started by announcing the correct path, but then stopped announcing that path, allowing the attacker to repeat the same hijack. This second hijack lasted nearly 10 hours before Hetzner responded.

Softaculous, Hetzner Online, and Zet.net, a transit peer, all failed to properly monitor their systems and did not notice the hijacking until it had been going on for about 22 hours. The attack also raised questions about another hosting provider, Nexon Host, whose infrastructure appeared to facilitate the malicious announcement.

Ben Cartwright-Cox, a BGP expert and creator of the BGP Tools suite, called the lapses “silly, preventable mistakes.” Softaculous, Hetzner, and Zet.net didn't immediately respond to emailed questions.

How BGP hijacking works

The attack targeted the fundamental technology that keeps the Internet connected. The Internet is divided into many autonomous systems (ASes), each assigned a portion of the 3.7 billion public IPv4 addresses. BGP is the protocol that lets these ASes route traffic to each other, based on announcements that declare which networks should transit traffic.

In the early days, BGP ran on trust, but attackers have repeatedly abused that trust. Both nation-state actors and financially motivated groups have used hijacks to redirect data. Over time, protections like RPKI (Resource Public Key Infrastructure) ROV (Route Origin Validation) were developed to prevent such attacks. RPKI ROV uses cryptographic records called Route Origin Authorizations (ROAs) to verify the origin and prefix length of routes, causing ASes that deploy it to reject unmatched routes.

The attack timeline

The attack began just before 9 PM UTC on a Friday, when a new IP prefix, designated as 162.55.80.0/24, appeared on the global routing table. The prefix was announced along a path involving Zet.net (AS6204), Nexon Host (AS62390), and Hetzner Online (AS24940).

That /24 block, which contains 256 addresses, hosted Softaculous's software update endpoint and its client and billing site. It was a more-specific chunk of the larger 162.55.0.0/16 space, typically originated by Hetzner Online. According to BGP expert Doug Madory, head of Internet analysis at Infoblox, the announcement likely originated with NexonHost (AS62390), possibly through a compromise of its infrastructure or a customer who exploited gaps in its security.

The hijack included an AS path with a forged origin. Because the attacker appended AS24940 as the rightmost ASN, the route was considered RPKI-valid. The ROA required the origin to be AS24940 and allowed the prefix length to be between /24 and /16, so the attack route was not dropped by ASes that reject RPKI-invalid routes. Madory noted that Hetzner Online configured its RPKI parameters to allow sub-prefixes as small as /24, which, combined with the forged AS path, let the hijack bypass protections.

“Because there was no existing route for 162.55.80.0/24 to compete against, it propagated as far as other route filtering mechanisms would allow,” Madory wrote. “And because it was a more-specific route, any traffic destined for this IP range would prefer it over the legitimate route (162.55.0.0/16) due to routers' preference for longest-prefix-match.”

Cartwright-Cox explained the flaw succinctly: “Hetzner allowed more precise IP ranges (/24 when it should have been /16) to be announced, allowing the hijacker to impersonate them and automatically win on routing decisions.”

Bypassing TLS certificate checks

The smaller /24 range also made it possible for the attackers to bypass industry-wide measures for validating TLS certificate requests. Under normal conditions, the party requesting a certificate must demonstrate control of the domain from multiple geographically dispersed points. Let's Encrypt, the certificate authority that issued the certificates used in the hijacking, requires a quorum of those validation checks to return positive before issuing a certificate.

By targeting the smaller /24 range, the hijack spread globally, “causing the validation perspectives (and all other traffic) to reach the attacker's server instead of the legitimate domain operator,” Let's Encrypt said in an email. The CA said that Certification Authority Authorization (CAA) account binding, which limits acceptable issuers and validation methods, “would have made this significantly more difficult for the attacker.”

Rare malware-spreading hijack

It remains unclear how many servers received the malicious update or what the malware did once installed. This incident is one of the few times a BGP hijacking has been used to spread malware. In 2015, the mercenary hacker collective Hacking Team used one against a target it was contracted to infect. In 2022, attackers hijacked IP addresses belonging to Amazon to host a smart contract that drained about $235,000 in bitcoin from people trying to visit the Celer Bridge cryptocurrency exchange.

BGP hijackings have become less common thanks to RPKI adoption, but this weekend's event shows that one configuration mistake can still break the protections.

What this means for you

For anyone running a Virtualizor or Softaculous installation, the incident is a direct call to action. Softaculous has urged all users to check their systems for signs of compromise, and since it cannot provide a definitive list of affected servers, every Virtualizor deployment should be treated as potentially exposed.

The attack demonstrates that even with RPKI in place, a single misconfiguration at a hosting provider can create a window for a targeted hijack. It also highlights the importance of code-signing in update mechanisms — had Softaculous cryptographically verified its update packages, the malicious updates would have been rejected. For businesses and individuals who rely on cloud management platforms, this is a reminder to confirm that software vendors follow basic security hygiene, like validating updates, and to stay vigilant for unexpected changes in network behavior.