BGP Hijack Intercepts Softaculous Infrastructure to Serve Malicious Virtualizor Updates via Forged TLS Certificates
A sophisticated BGP hijacking incident recently targeted Softaculous update infrastructure, redirecting legitimate traffic intended for Virtualizor services to attacker-controlled infrastructure. The attack impacted the IP prefix `162.55.80.0/24`, hosted within Hetzner's network, between August 28 and August 30, 2026. The incident occurred because AS62390 (NexonHost) announced an unauthorized, more-specific `/24` prefix via transit provider AS6204 (Zet.net) against Hetzner's broader `162.55.0.0/16` route. Standard BGP route selection favored this more-specific prefix, drawing substantial global traffic away from authentic endpoints. To evade simple origin-AS monitoring, the attackers appended Hetzner's legitimate AS number (`AS24940`) to the tail of the AS path. Once traffic was diverted, the attackers solved automated Let's Encrypt domain validation challenges over the hijacked route, issuing valid TLS certificates for `virtualizor.com`, `api.virtualizor.com`, and `files.virtualizor.com`. Because client machines connected securely over HTTPS without encountering certificate validation warnings, malicious software update packages were delivered directly to systems querying update endpoints during the window. Public routing data from RIPE RIS showed two major interception waves: one starting late on August 28 and another spanning August 29 through the morning of August 30. During peak diversion periods, approximately 72% of all RIPE RIS collector peers followed the malicious route. Softaculous confirmed that malicious packages were delivered to a small number of servers, though legitimate servers received no logs because the traffic never reached authentic Softaculous infrastructure.
Commentary
This incident is a textbook demonstration of why relying solely on HTTPS/TLS domain validation (such as standard ACME HTTP-01/DNS-01 challenges) falls short against network-level routing attacks. When an adversary can temporarily hijack a BGP route, they can effortlessly pass automated Let's Encrypt validation checks, effectively weaponizing the public PKI ecosystem against endpoint trust assumptions. Any organization running Virtualizor virtualization control panels must audit system logs immediately. Check whether your hypervisors or management nodes initiated outbound connections to `api.virtualizor.com` or `files.virtualizor.com` between 20:57 UTC on August 28 and 06:10 UTC on August 30, 2026. Because the vendor cannot identify affected IPs due to traffic diversion, any system that updated or polled update mirrors during the active windows should be treated as potentially compromised and verified against known-good package checksums or rebuilt from clean images. Broader remediation points to the urgent adoption of RPKI Route Origin Authorizations (ROAs) and strict Route Origin Validation (ROV) by upstream transit providers. While RPKI alone does not completely eradicate AS-path spoofing without ASPA (Autonomous System Provider Authorization), proper upstream filtering and cryptographic signing of software binaries (e.g., Sigstore, TUF, or static vendor PGP signatures checked independent of the transport layer) are essential to prevent transport hijacks from becoming full remote code execution supply chain attacks.
The Quote to Remember
“The hijacked route retained AS24940, Hetzner’s autonomous system number, at the end of the AS path. This made Hetzner appear to remain the origin network in routing data, potentially making the false route less conspicuous to automated monitoring systems focused only on origin-AS changes.”
“Because malicious responses were delivered directly from attacker infrastructure, they never reached Softaculous’ own logs, leaving the full scope of affected servers uncertain.”