BGP hijack infecting networks caused by a comedy of errors that’s not funny at all
ars ·
Hackers executed a supply chain attack by hijacking an IP address block belonging to Softaculous, a UAE-based maker of web management software including Virtualizor, to push malware disguised as software updates. The attack exploited lax routing security at Hetzner Online, Softaculous' hosting provider, along with Softaculous' failure to cryptographically verify update packages. The hijack misdirected traffic over two spans in a 33-hour window; Hetzner reclaimed the IP space after 12 hours but it was hijacked again, with slow responses from Hetzner, Softaculous, and Zet.net. Attackers forged the AS path to make the route appear RPKI-valid and used a more-specific /24 prefix to win routing decisions, also bypassing TLS certificate validation from Let's Encrypt. The incident is among the rare known cases of BGP hijacking used to spread malware, and it underscores how a single configuration mistake can undermine routing protections even with widespread RPKI adoption. Softaculous stated only a small number of servers were likely affected but urged all Virtualizor users to check for compromise, as a definitive list was unavailable.
ars