{"id":183229,"date":"2026-09-02T10:53:39","date_gmt":"2026-09-02T08:53:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/atakuyushhie-ispolzovali-bgp-dlya-podmeny-servera-obnovlenij-virtualizor-i-sajta-softaculous"},"modified":"2026-09-02T10:53:42","modified_gmt":"2026-09-02T08:53:42","slug":"attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website","title":{"rendered":"Attackers used BGP to substitute the Virtualizor update server and the Softaculous website","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The attackers were able to substitute the infrastructure elements of Softaculous, implementing a fake route via the BGP protocol, which allowed them to redirect the subnet traffic from Softaculous servers to a server controlled by the attackers. As a result of the attack, among other things, they managed to redirect requests to the company\u2019s client website, billing system, and update distribution servers for Virtualizor software, and then use them to distribute malware and attack the company's clients. The attackers were able to obtain valid TLS certificates for the Softaculous domains through the Let’s Encrypt service, since the automated domain ownership verification was successfully passed through the substituted hosts. <\/p>\n

Softaculous provides the namesake platform for automating the installation of web applications, integrated with hosting control panels<\/a> cPanel, Plesk, DirectAdmin, and ispmanager, and also develops the SitePad website builder, the Webuzo hosting control panel, the Backuply backup system, and the Virtualizor panel for managing virtual servers. During the attack, attackers managed to publish a fake update to the Virtualizor panel containing malicious code. The number of users who installed this update is still unclear. <\/p>\n

A fake BGP announcement that changed routing for the subnet 162.55.80.0\/24 was sent from the autonomous system AS62390 (NexonHost) via the transit provider AS6204 (Zet.net). The routing disruption lasted for 33 hours, from August 28 23:57 (MSK) to August 30 08:50 (MSK). The probability of a request passing through the server<\/a> attacker during peak phases of the attack was estimated at 72% (266 out of 368 BGP peers applied the fake route). <\/p>\n

Users of Softaculous products, who are typically hosting providers, are advised to check their systems for signs of malware activity and to change their access passwords for Softaculous services. Administrators of Virtualizor are advised to consider their systems as potentially compromised and to change API access keys and client keys. One of the indicators of compromise is the appearance of the file «\\\/etc\\\/systemd\\\/system\\\/java-jre-update.service» in the system. Clients who entered their credit card numbers on the softaculous.com\\\/clients site during the attack should check for suspicious transactions. <\/p>\n

Domains affected by the attack: <\/p>\n