{"id":183229,"date":"2026-09-02T10:53:39","date_gmt":"2026-09-02T08:53:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/atakuyushhie-ispolzovali-bgp-dlya-podmeny-servera-obnovlenij-virtualizor-i-sajta-softaculous"},"modified":"2026-09-02T10:53:42","modified_gmt":"2026-09-02T08:53:42","slug":"attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website","title":{"rendered":"R\u00fcndajad kasutasid BGP-d Virtualizor ja Softaculous v\u00e4rskenduste serveri ja saidi valeandmiseks","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>R\u00fcndajad suudavad asendada Softaculous'i infrastruktuuri elemente, luues vale marsruudi BGP-protokolli kaudu, mis v\u00f5imaldab suunata allv\u00f5rgutrafiku Softaculous'i serveritest r\u00fcndajate kontrolli all olevasse serverisse. R\u00fcnnaku k\u00e4igus suudeti, muu hulgas, suunata p\u00f6\u00f6rdumisi ettev\u00f5tte kliendilehe, arvelduse ja Virtualizori tarkvarauuenduste levitamise serverite poole, kasutades neid pahavara levitamiseks ja ettev\u00f5tte klientide r\u00fcndamiseks. R\u00fcndajad said Let's Encrypti teenuse kaudu \u00f5iged TLS-sertifikaadid Softaculous'i domeenide jaoks, kuna domeeni omandi automaatne kontroll toimus asendatud hostide kaudu.         <\/p>\n<p>Ettev\u00f5te Softaculous pakub samanimelist platvormi veebirakenduste installimise automatiseerimiseks, mis on integreeritav <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/control-panel\/\"   title=\"hostimisjuhtpaneelidega\" data-wpil-keyword-link=\"linked\">hostimisjuhtpaneelidega<\/a> cPanel, Plesk, DirectAdmin ja ispmanager, arendades samuti veebilehtede koostaja SitePad, hostimisjuhtpaneeli Webuzo, varunduss\u00fcsteemi Backuply ja Virtuaalserverite haldamise paneeli Virtualizor. R\u00fcnnaku ajal \u00f5nnestus kurjategijatel avaldada vale uuendus Virtualizori paneelile, mis sisaldas pahatahtlikku kode. Kasutajate arv, kes selle uuenduse installisid, pole veel selge.    <\/p>\n<p>Vale BGP-anon\u00fc\u00fcs, mis muutis marsruutimist alamesse 162.55.80.0\/24, saadeti autonoomsest s\u00fcsteemist AS62390 (NexonHost) kaudu \u00fclemineku pakkuja AS6204 (Zet.net). Marsruutimise rikkumine kestis 33 tundi alates 28. augustist 23:57 (MSK) kuni 30. augustini 08:50 (MSK). T\u00f5en\u00e4osus, et p\u00e4ring l\u00e4bis <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/et\/server\/\"   title=\"server\" data-wpil-keyword-link=\"linked\">server<\/a> r\u00fcndaja tipphetkedel, r\u00fcnnaku ajal, hinnati 72% (266 368 BGP-peerist kasutas vale marsruuti).     <\/p>\n<p>Softaculous'i toodete kasutajatele, kes on enamasti veebihostinguteenuse pakkujad, soovitatakse kontrollida oma s\u00fcsteeme pahavara aktiivsuse osas ja muuta Softaculous'i teenuste paroolid. Virtualizori administraatoritele soovitatakse pidada oma s\u00fcsteeme potentsiaalselt kompromiteerituks ja vahetada API juurdep\u00e4\u00e4su v\u00f5tmed ning kliendiv\u00f5tmed. \u00dcheks kompromiteerimise indikaatoriks on faili \u201e\/etc\/systemd\/system\/java-jre-update.service\u201d ilmumine s\u00fcsteemis. Klientidel, kes r\u00fcnnaku ajal sisestasid oma maksekaardi numbrid aadressil softaculous.com\/clients, soovitatakse kontrollida kahtlaste tehingute olemasolu.    <\/p>\n<p>Domeenid, mida r\u00fcnnak puudutas:  <\/p>\n<ul>\n<li>a.softaculous.com,\n<li>ampps.com,\n<li>api.sitepad.com,\n<li>api.softaculous.com,\n<li>api.virtualizor.com,\n<li>api.webuzo.com,\n<li>backuply.com,\n<li>files.ampps.com,\n<li>files.sitepad.com,\n<li>files.softaculous.com,\n<li>files.virtualizor.com,\n<li>files.webuzo.com,\n<li>pagelayer.com,\n<li>popularfx.com,\n<li>server.softaculous.com,\n<li>sitepad.com,\n<li>softaculous.com, v\n<li>irtualizor.com,\n<li>webuzo.com,\n<li>www.ampps.com,\n<li>www.backuply.com,\n<li>www.popularfx.com,\n<li>www.sitepad.com,\n<li>www.softaculous.com,\n<li>www.virtualizor.com,\n<li>www.webuzo.com.  <\/ul>\n<p>Allikas: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66196\">opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Softaculous, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0432 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b BGP, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 Softaculous \u043d\u0430 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0439 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0441\u0435\u0440\u0432\u0435\u0440. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0442\u0430\u043a\u0438, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u043c\u0443 web-\u0441\u0430\u0439\u0442\u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0431\u0438\u043b\u043b\u0438\u043d\u0433\u0443 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u041f\u041e Virtualizor, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183229","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.1.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Softaculous, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0432 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b BGP, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 Softaculous.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/et\/blog\/news\/attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.1.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"et_EE\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 BGP \u0434\u043b\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 Virtualizor \u0438 \u0441\u0430\u0439\u0442\u0430 Softaculous | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Softaculous, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0432 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b BGP, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 Softaculous.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/et\/blog\/news\/attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-02T08:53:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-02T08:53:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47R\u00fcndajad kasutasid BGP-d, et asendada Virtualizori uuenduss\u00fcsteemi ja Softaculousi veebilehte | ProHoster","description":"R\u00fcndajad suutsid asendada Softaculousi infrastruktuuri komponente, rakendades vale marsruuti BGP protokolli kaudu, mille tulemusena \u00f5nnestus suunata alamsubtiit Softaculousi serverite liiklus.","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 BGP \u0434\u043b\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 Virtualizor \u0438 \u0441\u0430\u0439\u0442\u0430 Softaculous | ProHoster","og:description":"\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Softaculous, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0432 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b BGP, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 Softaculous.","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-09-02T08:53:39+00:00","article:modified_time":"2026-09-02T08:53:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183229","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=183229"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183229\/revisions"}],"predecessor-version":[{"id":183230,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/183229\/revisions\/183230"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=183229"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=183229"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=183229"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}