{"id":183229,"date":"2026-09-02T10:53:39","date_gmt":"2026-09-02T08:53:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/atakuyushhie-ispolzovali-bgp-dlya-podmeny-servera-obnovlenij-virtualizor-i-sajta-softaculous"},"modified":"2026-09-02T10:53:42","modified_gmt":"2026-09-02T08:53:42","slug":"attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website","title":{"rendered":"\u00dato\u010dn\u00edci pou\u017eili BGP k podvr\u017een\u00ed aktualiza\u010dn\u00edho serveru Virtualizor a webu Softaculous.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\u00dato\u010dn\u00edk\u016fm se poda\u0159ilo vym\u011bnit prvky infrastruktury spole\u010dnosti Softaculous, kdy\u017e nahradili fale\u0161nou trasu p\u0159es protokol BGP, d\u00edky \u010demu\u017e dok\u00e1zali p\u0159esm\u011brovat provoz pods\u00edt\u011b se servery Softaculous na servery pod jejich kontrolou. V d\u016fsledku \u00fatoku se mimo jin\u00e9 poda\u0159ilo p\u0159esm\u011brovat po\u017eadavky na klientsk\u00fd web spole\u010dnosti, na billing a servery pro distribuci aktualizac\u00ed pro software Virtualizor, a n\u00e1sledn\u011b je pou\u017e\u00edt k distribuci malwaru a \u00fatok\u016fm na klienty spole\u010dnosti. \u00dato\u010dn\u00edci si prost\u0159ednictv\u00edm slu\u017eby Let\u2019s Encrypt zajistili platn\u00e9 TLS certifik\u00e1ty pro dom\u00e9ny Softaculous, proto\u017ee automatick\u00e1 kontrola vlastnictv\u00ed dom\u00e9n prob\u011bhla p\u0159es podvr\u017een\u00e9 hostitele. <\/p>\n

Spole\u010dnost Softaculous poskytuje stejnojmennou platformu pro automatizaci instalace webov\u00fdch aplikac\u00ed, kterou lze integrovat s \u0159\u00edd\u00edc\u00edmi panely hostingu.<\/a> cPanel, Plesk, DirectAdmin a ispmanager, a tak\u00e9 vyv\u00edj\u00ed n\u00e1stroj pro tvorbu str\u00e1nek SitePad, \u0159\u00edd\u00edc\u00ed panel hostingu Webuzo, syst\u00e9m z\u00e1lohov\u00e1n\u00ed Backuply a panel Virtualizor pro spr\u00e1vu virtu\u00e1ln\u00edch server\u016f. B\u011bhem \u00fatoku se \u00fato\u010dn\u00edk\u016fm poda\u0159ilo publikovat fale\u0161nou aktualizaci pro panel Virtualizor, kter\u00e1 obsahovala \u0161kodliv\u00fd k\u00f3d. Po\u010det u\u017eivatel\u016f, kte\u0159\u00ed tuto aktualizaci nainstalovali, zat\u00edm nen\u00ed jasn\u00fd. <\/p>\n

Fale\u0161n\u00fd BGP ozn\u00e1men\u00ed, kter\u00e9 m\u011bn\u00ed routov\u00e1n\u00ed pro pods\u00ed\u0165 162.55.80.0\/24, bylo odesl\u00e1no z autonomn\u00edho syst\u00e9mu AS62390 (NexonHost) prost\u0159ednictv\u00edm tranzitn\u00edho poskytovatele AS6204 (Zet.net). Poru\u0161en\u00ed routov\u00e1n\u00ed trvalo 33 hodin od 28. srpna 23:57 (MSK) do 30. srpna 08:50 (MSK). Pravd\u011bpodobnost, \u017ee po\u017eadavek pro\u0161el skrze server<\/a> \u00fato\u010dn\u00edka v nejintenzivn\u011bj\u0161\u00edch f\u00e1z\u00edch \u00fatoku byla odhadov\u00e1na na 72% (266 z 368 BGP peer\u016f pou\u017eilo fale\u0161nou trasu). <\/p>\n

U\u017eivatel\u016fm produkt\u016f Softaculous, kter\u00fdmi obvykle jsou poskytovatel\u00e9 hostingu, se doporu\u010duje zkontrolovat sv\u00e9 syst\u00e9my na p\u0159\u00edtomnost aktivity malwaru a zm\u011bnit heslo pro p\u0159\u00edstup k slu\u017eb\u00e1m Softaculous. Spr\u00e1vc\u016fm Virtualizoru se doporu\u010duje pova\u017eovat sv\u00e9 syst\u00e9my za potenci\u00e1ln\u011b kompromitovan\u00e9 a zm\u011bnit p\u0159\u00edstupov\u00e9 kl\u00ed\u010de k API a klientsk\u00e9 kl\u00ed\u010de. Jako jeden z indik\u00e1tor\u016f kompromitace se uv\u00e1d\u00ed p\u0159\u00edtomnost souboru \u201e\/etc\/systemd\/system\/java-jre-update.service\u201c v syst\u00e9mu. Klienti, kte\u0159\u00ed b\u011bhem \u00fatoku zad\u00e1vali \u010d\u00edsla platebn\u00edch karet na webu softaculous.com\/clients, by m\u011bli zkontrolovat p\u0159\u00edtomnost podez\u0159el\u00fdch transakc\u00ed. <\/p>\n

Dom\u00e9ny, kter\u00e9 \u00fatok zas\u00e1hl: <\/p>\n