BGP Hijack Let Hackers Push Fake Updates to Virtualizor Servers for 33 Hours

Hackers pulled off a supply chain attack by hijacking the internet routing for a hosting company's own infrastructure, and it worked because almost nobody involved was watching.

The target was Softaculous, a United Arab Emirates-based company that makes Virtualizor, software used to manage virtualized servers across data centers and hosting providers. According to GB Hackers, the attack hit the IP range 162.55.80.0/24, a block hosted inside Hetzner Online's infrastructure, from roughly 20:57 UTC on August 28, 2026 to 06:10 UTC on August 30, 2026.

Here's the mechanism. An unauthorized network, AS62390, identified as NexonHost, announced a more-specific route for that IP block through a transit provider called Zet.net, AS6204. Under standard Border Gateway Protocol behavior, networks default to the more specific route. So traffic meant for Softaculous got rerouted straight to the attacker, according to GB Hackers.

The attackers were careful. They kept Hetzner's own autonomous system number, AS24940, sitting at the tail end of the route path, which made the hijacked route look less suspicious to any monitoring system that only checks for changes at the origin. That is a deliberate design choice by whoever ran this operation, not luck.

With the traffic rerouted, the attacker then requested a Let's Encrypt TLS certificate for virtualizor.com, api.virtualizor.com, and files.virtualizor.com. Because the domain-validation checks themselves got routed through the hijack, Let's Encrypt issued a technically valid certificate to the attacker. That meant victims connecting to what they thought was Softaculous saw a clean HTTPS connection with no warning. Their browsers and update clients had no reason to be suspicious.

Virtualizor's update client did not cryptographically verify update packages before installing them, the company admitted in a Monday advisory cited by Ars Technica. Code signing on software updates is one of the most basic security practices in the industry. Softaculous skipped it. So when the attacker served a modified update package from its hijacked server, there was nothing stopping it from installing.

Softaculous says it believes only a small number of servers were actually compromised, but told customers it "cannot produce a definitive list," and is telling every Virtualizor operator to check their systems as if they were affected, according to Ars Technica.

Nobody Was Watching

The hijack didn't run continuously. Public routing data from RIPE's Routing Information Service, cited by GB Hackers, shows two separate waves. The first ran from about 21:00 UTC on August 28 to 08:50 UTC on August 29, when Hetzner briefly reclaimed the address space by re-announcing the correct route. Then Hetzner stopped announcing it, and the attacker relaunched the hijack around 20:00 UTC on August 29, running until the route was finally withdrawn around 06:00 UTC on August 30.

All 368 RIPE RIS collector peers observed the hijacked route at some point, and during the active windows a median of 266 peers, about 72% of the full set, were following the malicious path, according to GB Hackers' review of the incident report.

Ars Technica reports the hijack went undetected for 22 hours despite three separate companies having visibility into it: Hetzner, which owns the address space; Softaculous, whose customers were the target; and Zet.net, the transit provider that carried the bogus announcement downstream. None of them caught it in real time. Ars Technica also flagged unresolved questions about NexonHost, the network whose infrastructure was used to send the fraudulent announcement in the first place.

Ben Cartwright-Cox, a BGP expert who built the BGP Tools monitoring suite, called the chain of failures "silly, preventable mistakes," according to Ars Technica.

BGP hijacking itself is not new or exotic. Route-origin validation exists specifically to stop this kind of attack, and it is Hetzner's job to configure it properly on infrastructure that hosts a software update server. Code signing exists specifically to stop a hijacked update channel from installing malware, and it was Softaculous's job to implement it. Neither happened.

Softaculous, Hetzner, and Zet.net did not respond to questions from Ars Technica about the incident. Softaculous says its investigation is ongoing and it has not found evidence that its other products were affected. Virtualizor operators are still being told to treat every server as potentially compromised, because the company that built the software cannot tell them for certain which ones actually were.