#routing

BGP Hijack Intercepts Softaculous Infrastructure to Serve Malicious Virtualizor Updates via Forged TLS Certificates

A sophisticated BGP hijacking incident recently targeted Softaculous update infrastructure, redirecting legitimate traffic intended for Virtualizor services to attacker-controlled infrastructure. The attack impacted the IP prefix `162.55.80.0/24`, hosted within Hetzner's network, between August 28 and August 30, 2026. The incident occurred because AS62390 (NexonHost) announced an unauthorized, more-specific `/24` prefix via transit provider AS6204 (Zet.net) against Hetzner's broader `162.55.0.0/16` route. Standard BGP route selection favored this more-specific prefix, drawing substantial global traffic away from authentic endpoints. To evade simple origin-AS monitoring, the attackers appended Hetzner's legitimate AS number (`AS24940`) to the tail of the AS path. Once traffic was diverted, the attackers solved automated Let's Encrypt domain validation challenges over the hijacked route, issuing valid TLS certificates for `virtualizor.com`, `api.virtualizor.com`, and `files.virtualizor.com`. Because client machines connected securely over HTTPS without encountering certificate validation warnings, malicious software update packages were delivered directly to systems querying update endpoints during the window. Public routing data from RIPE RIS showed two major interception waves: one starting late on August 28 and another spanning August 29 through the morning of August 30. During peak diversion periods, approximately 72% of all RIPE RIS collector peers followed the malicious route. Softaculous confirmed that malicious packages were delivered to a small number of servers, though legitimate servers received no logs because the traffic never reached authentic Softaculous infrastructure.