BGP Hijack Delivers Malware Through Softaculous Update Infrastructure
Unknown attackers carry out a supply chain attack by hijacking a portion of Internet space used to deliver updates for software from Softaculous, a UAE-based company behind Virtualizor, a platform for managing virtualized environments. By exploiting weaknesses in routing security at hosting provider Hetzner Online and gaps in the TLS certificate issuance process, the attackers gain control over IP addresses assigned to Softaculous and use them to distribute malware disguised as legitimate software updates to hosting providers, data centers, and other infrastructure companies.
The attackers succeed due to a chain of preventable errors. A loose routing security configuration at Hetzner Online allows the hijackers to intermittently misdirect traffic over two spans within a 33-hour window. Meanwhile, Softaculous fails to implement code signing, one of the most basic safeguards in software development, meaning its update clients do not cryptographically verify update packages. As a result, modified malicious packages are not rejected. Softaculous warns that any Virtualizor installation whose traffic is diverted during the incident window could have received a malicious update, and while the company believes only a small number of servers are affected, it cannot produce a definitive list and urges customers to treat every Virtualizor server as in scope for investigation.
The incident serves as a reminder that Internet routing security depends on multiple layers working together, and that a single weak link can undermine the rest. BGP, the protocol that governs how traffic flows across the Internet, remains vulnerable to hijacking when providers do not enforce protections such as RPKI validation. Combined with the absence of code signing on the software side, the attack demonstrates how a comedy of errors, none of which is particularly sophisticated on its own, can combine into a serious breach affecting production networks.