BGP hijacking incident diverts traffic, targeting Softaculous and Virtualizor users

As outlined in The Register, a significant Border Gateway Protocol (BGP) hijacking incident lasting 33 hours has prompted urgent security advisories for customers of Softaculous and Virtualizor. The attack involved diverting traffic and delivering malware to a limited number of server installations.

The incident began around 20:57 UTC on August 28, when an unknown network began announcing a block of IP addresses belonging to Hetzner, a Softaculous upstream provider. This BGP hijack diverted traffic intended for Softaculous's systems, including its client and billing site and the Virtualizor software update endpoint, to an attacker-controlled server. The attacker exploited a more specific IP address announcement to override normal routing and secured a valid TLS certificate from Let's Encrypt by routing the domain validation through the hijacked network. This allowed connections to bypass certificate warnings.

Softaculous reported the issue to Hetzner, which initially mitigated the hijack for about 11 hours. However, the unauthorized route returned, continuing the diversion for another 10 hours before normal routing was restored on August 30. During the active waves, an estimated 72% chance existed for a given server to route affected traffic through the attacker. Customers who logged in or entered payment details during the incident are advised to reset credentials and monitor statements. A malicious Virtualizor update package was delivered to a handful of installations, as the update client did not cryptographically verify packages. Softaculous is urging all Virtualizor operators to inspect their servers for indicators of compromise, such as a specific systemd unit, and to rotate API credentials and check for unauthorized access.

Source: The Register