Security
BGP Hijack Enabled Malware Distribution Through Cloud Management Platform
A sophisticated supply chain attack exploited routing security flaws and missing code-signing checks to inject malware into networks relying on popular infrastructure software.
Ars Technica
Unknown attackers orchestrated a targeted supply chain assault that leveraged internet routing vulnerabilities to distribute malware to infrastructure operators. The campaign succeeded by hijacking IP address space belonging to Softaculous, a UAE-based firm that provides software installation platforms and virtualization management tools widely deployed across hosting providers and data centers.
The Attack Method#
The attackers exploited two critical weaknesses: lax Border Gateway Protocol (BGP) configuration at hosting provider Hetzner Online, and inadequate TLS certificate processes. By hijacking Softaculous' assigned IP addresses, the operators were able to intercept traffic destined for the company's update servers and billing portal. They then hosted malicious software packages that masqueraded as legitimate updates, pushing compromised code to installations expecting security patches.
A Cascade of Preventable Failures#
The successful breach exposed a series of defensive gaps. Most significantly, Softaculous had failed to implement code signing on software updates—a foundational security practice in development. This meant that compromised update packages could reach systems without any cryptographic verification to flag tampering.
Hetzner's routing configuration allowed the hijack to persist across two separate windows totaling 33 hours. After the first incident was detected 12 hours in, Hetzner restored the correct routing path but then stopped announcing it altogether, enabling the attacker to repeat the hijack. The second episode took Hetzner almost 10 hours to remediate.
Scope of the Damage#
Softaculous acknowledged that a small number of servers likely received malicious packages during the attack window but stated it cannot definitively identify all affected systems. The company advised treating every Virtualizor deployment as potentially compromised and recommended thorough verification checks.
Learn more on Softaculous' incident post.
