{"id":183229,"date":"2026-09-02T10:53:39","date_gmt":"2026-09-02T08:53:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/atakuyushhie-ispolzovali-bgp-dlya-podmeny-servera-obnovlenij-virtualizor-i-sajta-softaculous"},"modified":"2026-09-02T10:53:42","modified_gmt":"2026-09-02T08:53:42","slug":"attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website","title":{"rendered":"Atacatorii au folosit BGP pentru a substitui serverul de actualiz\u0103ri Virtualizor \u0219i site-ul Softaculous","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Atacatorii au reu\u0219it s\u0103 \u00eenlocuiasc\u0103 elementele de infrastructur\u0103 ale companiei Softaculous, implement\u00e2nd un traseu fals prin protocolul BGP, prin care au reu\u0219it s\u0103 redirec\u021bioneze traficul subre\u021belei cu serverele Softaculous c\u0103tre un server controlat de atacatori. Ca urmare a atacului, printre altele, s-au redirec\u021bionat solicit\u0103rile c\u0103tre site-ul web al companiei, sistemul de facturare \u0219i serverele de distribu\u021bie a actualiz\u0103rilor pentru software-ul Virtualizor, ulterior folosindu-le pentru a r\u0103sp\u00e2ndi software mali\u021bios \u0219i a ataca clien\u021bii companiei. Atacatorii au reu\u0219it s\u0103 ob\u021bin\u0103 prin serviciul Let's Encrypt certificate TLS valide pentru domeniile Softaculous, deoarece verificarea automat\u0103 a propriet\u0103\u021bii domeniilor a fost realizat\u0103 prin gazde falsificate.         <\/p>\n<p>Compania Softaculous furnizeaz\u0103 platforma cu acela\u0219i nume pentru automatizarea instal\u0103rii aplica\u021biilor web, integrabil\u0103 cu <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/control-panel\/\"   title=\"panourile de control pentru hosting\" data-wpil-keyword-link=\"linked\">panourile de control pentru hosting<\/a> cPanel, Plesk, DirectAdmin \u0219i ispmanager, precum \u0219i dezvolt\u0103 constructorul de site-uri SitePad, panoul de control pentru hosting Webuzo, sistemul de backup Backuply \u0219i panoul Virtualizor pentru gestionarea serverelor virtuale. \u00cen timpul atacului, infractorilor le-a reu\u0219it s\u0103 publice o actualizare fals\u0103 pentru panoul Virtualizor, con\u021bin\u00e2nd cod mali\u021bios. Num\u0103rul utilizatorilor care au instalat aceast\u0103 actualizare nu este \u00eenc\u0103 clar.    <\/p>\n<p>Anun\u021bul BGP fals, care schimb\u0103 rutarea pentru subre\u021beaua 162.55.80.0\/24, a fost trimis din sistemul autonom AS62390 (NexonHost) prin intermediul furnizorului de transit AS6204 (Zet.net). \u00cenc\u0103lcarea rut\u0103rii a durat 33 de ore, de la 28 august 23:57 (MSK) p\u00e2n\u0103 la 30 august 08:50 (MSK). Probabilitatea ca o cerere s\u0103 treac\u0103 prin <a class=\"wpil_keyword_link\" href=\"https:\/\/prohoster.info\/ro\/server\/\"   title=\"serverul\" data-wpil-keyword-link=\"linked\">serverul<\/a> atacator \u00een fazele de v\u00e2rf ale atacului a fost evaluat\u0103 la 72% (266 din 368 de perechi BGP au aplicat ruta fals\u0103).     <\/p>\n<p>Utilizatorilor produselor Softaculous, care de obicei sunt furnizori de g\u0103zduire, li se recomand\u0103 s\u0103 \u00ee\u0219i verifice sistemele pentru activit\u0103\u021bi de software mali\u021bios \u0219i s\u0103 schimbe parolele de acces la serviciile Softaculous. Administratorilor Virtualizor li se recomand\u0103 s\u0103 considere sistemele lor poten\u021bial compromise \u0219i s\u0103 schimbe cheile de acces la API \u0219i cheile clien\u021bilor. Ca unul dintre indicii de compromitere se semnaleaz\u0103 apari\u021bia \u00een sistem a fi\u0219ierului \"\/etc\/systemd\/system\/java-jre-update.service\". Clien\u021bii care au introdus \u00een timpul atacului numerele cardurilor de plat\u0103 pe site-ul softaculous.com\/clients ar trebui s\u0103 verifice existen\u021ba unor tranzac\u021bii suspecte.    <\/p>\n<p>Domenii afectate de atac:  <\/p>\n<ul>\n<li>a.softaculous.com,\n<li>ampps.com,\n<li>api.sitepad.com,\n<li>api.softaculous.com,\n<li>api.virtualizor.com,\n<li>api.webuzo.com,\n<li>backuply.com,\n<li>files.ampps.com,\n<li>files.sitepad.com,\n<li>files.softaculous.com,\n<li>files.virtualizor.com,\n<li>files.webuzo.com,\n<li>pagelayer.com,\n<li>popularfx.com,\n<li>server.softaculous.com,\n<li>sitepad.com,\n<li>softaculous.com, v\n<li>irtualizor.com,\n<li>webuzo.com,\n<li>www.ampps.com,\n<li>www.backuply.com,\n<li>www.popularfx.com,\n<li>www.sitepad.com,\n<li>www.softaculous.com,\n<li>www.virtualizor.com,\n<li>www.webuzo.com.  <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=66196\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Softaculous, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0432 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b BGP, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 Softaculous \u043d\u0430 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b\u0439 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0441\u0435\u0440\u0432\u0435\u0440. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u0430\u0442\u0430\u043a\u0438, \u0441\u0440\u0435\u0434\u0438 \u043f\u0440\u043e\u0447\u0435\u0433\u043e, \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u044f \u043a \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u043c\u0443 web-\u0441\u0430\u0439\u0442\u0443 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438, \u0431\u0438\u043b\u043b\u0438\u043d\u0433\u0443 \u0438 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u041f\u041e Virtualizor, \u043f\u043e\u0441\u043b\u0435 \u0447\u0435\u0433\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":10,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-183229","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Softaculous, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0432 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b BGP, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 Softaculous.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Alexander Kovalev\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 BGP \u0434\u043b\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 Virtualizor \u0438 \u0441\u0430\u0439\u0442\u0430 Softaculous | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Softaculous, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0432 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b BGP, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 Softaculous.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-09-02T08:53:39+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-09-02T08:53:42+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Atacatorii au folosit BGP pentru a substitui serverul de actualiz\u0103ri Virtualizor \u0219i site-ul Softaculous | ProHoster","description":"Atacatorii au reu\u0219it s\u0103 substituie elementele infrastructurii companiei Softaculous, realiz\u00e2nd o substitu\u021bie fals\u0103 a rutei prin protocolul BGP, ceea ce a permis redirec\u021bionarea traficului subre\u021belei c\u0103tre serverele Softaculous.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 BGP \u0434\u043b\u044f \u043f\u043e\u0434\u043c\u0435\u043d\u044b \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 Virtualizor \u0438 \u0441\u0430\u0439\u0442\u0430 Softaculous | ProHoster","og:description":"\u0410\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0435 \u0441\u043c\u043e\u0433\u043b\u0438 \u043f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u044d\u043b\u0435\u043c\u0435\u043d\u0442\u044b \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Softaculous, \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0432 \u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0433\u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0430 \u0447\u0435\u0440\u0435\u0437 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b BGP, \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u043c\u0443 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u043c\u0438 Softaculous.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-09-02T08:53:39+00:00","article:modified_time":"2026-09-02T08:53:42+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"183229","title":null,"description":null,"keywords":null,"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2026-09-09 10:59:27","updated":"2026-09-09 10:59:27","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/183229","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=183229"}],"version-history":[{"count":1,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/183229\/revisions"}],"predecessor-version":[{"id":183230,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/183229\/revisions\/183230"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=183229"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=183229"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=183229"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}