{"id":183229,"date":"2026-09-02T10:53:39","date_gmt":"2026-09-02T08:53:39","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/atakuyushhie-ispolzovali-bgp-dlya-podmeny-servera-obnovlenij-virtualizor-i-sajta-softaculous"},"modified":"2026-09-02T10:53:42","modified_gmt":"2026-09-02T08:53:42","slug":"attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/news\/attackers-used-bgp-to-hijack-virtualizor-update-server-and-softaculous-website","title":{"rendered":"Sulmit\u00eb p\u00ebrdor\u00ebn BGP p\u00ebr t\u00eb z\u00ebvend\u00ebsuar serverin e azhornimeve t\u00eb Virtualizor dhe faqen e internetit t\u00eb Softaculous","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Sulmuesit arrit\u00ebn t\u00eb z\u00ebvend\u00ebsojn\u00eb element\u00ebt e infrastruktur\u00ebs s\u00eb kompanis\u00eb Softaculous, duke realizuar nj\u00eb z\u00ebvend\u00ebsim t\u00eb rrem\u00eb t\u00eb rrug\u00ebs p\u00ebrmes protokollit BGP, me an\u00eb t\u00eb cilit u arrit t\u00eb redirektohej trafiku i subnetit me serverat Softaculous n\u00eb nj\u00eb server t\u00eb kontrolluar nga sulmuesit. Si rezultat i sulmit, mes t\u00eb tjerash, u arrit t\u00eb redirektoheshin k\u00ebrkesat p\u00ebr faqen e internetit t\u00eb klientit t\u00eb kompanis\u00eb, faturimin dhe serverat e shp\u00ebrndarjes s\u00eb azhurnimeve p\u00ebr Softwaren Virtualizor, pas s\u00eb cil\u00ebs u p\u00ebrdor\u00ebn p\u00ebr shp\u00ebrndarjen e softuer\u00ebve t\u00eb d\u00ebmsh\u00ebm dhe sulme ndaj klient\u00ebve t\u00eb kompanis\u00eb. Sulmuesit arrit\u00ebn t\u00eb merrnin p\u00ebrmes sh\u00ebrbimit Let's Encrypt certifikata t\u00eb sakta TLS p\u00ebr domainet e Softaculous, pasi verifikimi automatik i pron\u00ebsis\u00eb s\u00eb domain\u00ebve kaloi p\u00ebrmes hosteve t\u00eb z\u00ebvend\u00ebsuar. <\/p>\n

Kompania Softaculous ofron platform\u00ebn e saj p\u00ebr automatizimin e instalimit t\u00eb aplikacioneve web, e cila \u00ebsht\u00eb e integrueshme me panelet e menaxhimit t\u00eb hostimit<\/a> cPanel, Plesk, DirectAdmin dhe ispmanager, si dhe zhvillon krijuesin e faqeve SitePad, panelin e menaxhimit t\u00eb hostimit Webuzo, sistemin e kopjimit Backuply dhe panelin Virtualizor p\u00ebr menaxhimin e server\u00ebve virtual\u00eb. Gjat\u00eb sulmit, autor\u00ebt arrit\u00ebn t\u00eb publikojn\u00eb nj\u00eb p\u00ebrdit\u00ebsim t\u00eb rrem\u00eb p\u00ebr panelin Virtualizor, q\u00eb p\u00ebrmbante kod t\u00eb d\u00ebmsh\u00ebm. Numri i p\u00ebrdoruesve q\u00eb instaluan k\u00ebt\u00eb p\u00ebrdit\u00ebsim ende nuk dihet. <\/p>\n

Nj\u00eb njoftim i rrem\u00eb BGP, q\u00eb ndryshonte rrug\u00ebzimin p\u00ebr n\u00ebnrrjetin 162.55.80.0\/24, u d\u00ebrgua nga sistemi autonom AS62390 (NexonHost) p\u00ebrmes ofruesit t\u00eb transit AS6204 (Zet.net). Shkelja e rrug\u00ebzimit vazhdoi p\u00ebr 33 or\u00eb nga 28 gushti 23:57 (MSK) deri m\u00eb 30 gusht 08:50 (MSK). Probabiliteti i kalimit t\u00eb k\u00ebrkes\u00ebs p\u00ebrmes server<\/a> sulmuesit n\u00eb fazat kulmore t\u00eb sulmit u vler\u00ebsua n\u00eb 72% (266 nga 368 BGP peer p\u00ebrdor\u00ebn rrug\u00ebn e rreme). <\/p>\n

P\u00ebrdoruesve t\u00eb produkteve Softaculous, t\u00eb cil\u00ebt zakonisht jan\u00eb ofrues banese, u rekomandohet t\u00eb kontrollojn\u00eb sistemet e tyre p\u00ebr aktivitete t\u00eb softuer\u00ebve t\u00eb d\u00ebmsh\u00ebm dhe t\u00eb ndryshojn\u00eb fjal\u00ebkalimin e aksesit n\u00eb sh\u00ebrbimet Softaculous. Administrator\u00ebt e Virtualizorit u rekomandohet ta shohin sistemin e tyre si t\u00eb mund\u00ebsisht t\u00eb komprometuar dhe t\u00eb ndryshojn\u00eb \u00e7el\u00ebsat e aksesit n\u00eb API dhe \u00e7el\u00ebsat e klient\u00ebve. Nj\u00eb nga indikator\u00ebt e komprometimit \u00ebsht\u00eb shfaqja n\u00eb sistem e skedarit \"\/etc\/systemd\/system\/java-jre-update.service\". Klient\u00ebt q\u00eb kan\u00eb futur numra kartash pagese n\u00eb faqen softaculous.com\/clients gjat\u00eb periudh\u00ebs s\u00eb sulmit, duhet t\u00eb kontrollojn\u00eb p\u00ebr transaksione t\u00eb dyshimta. <\/p>\n

Domainet q\u00eb u prek\u00ebn nga sulmi: <\/p>\n