BGP Hijack Delivers Malicious Virtualizor Update with Root Access
Attackers leveraged a BGP hijack to redirect Softaculous update traffic, delivering a malicious Virtualizor update that established persistent root access on five hypervisors.
Why it matters
This incident highlights a sophisticated supply chain compromise using BGP hijacking to inject malicious updates and gain persistent root access, posing a significant operational risk to hypervisor environments.
SOC impact
Defenders should focus on identifying affected hypervisors and monitoring update traffic for irregular routing or unexpected update sources. Review network telemetry for signs of BGP anomalies and audit systems for unauthorized root access.
Recommended actions
- Identify hypervisors that received the malicious Virtualizor update
- Review network telemetry for BGP hijack indicators or routing anomalies
- Audit root account activity on hypervisors during the incident window
- Investigate Softaculous update sources and integrity of update packages
- Assess overall exposure of virtualization infrastructure to suspicious update traffic
Executive Summary
A recent malicious campaign exploited BGP hijacking to redirect update traffic intended for Softaculous Virtualizor, resulting in the delivery of a compromised package. This package provided persistent root access on five confirmed hypervisors as of August 28. The attack demonstrates a novel approach to supply chain compromise by manipulating internet routing protocols to inject malicious content into trusted software updates. The operational consequence underscores the importance of monitoring update channels and network routes for unexpected changes, especially when managing critical virtualization infrastructure. Detecting such sophisticated attacks requires correlated analysis of network anomalies and system-level activity focusing on root access to hypervisors.
SOC Impact
Defenders should focus on identifying affected hypervisors and monitoring update traffic for irregular routing or unexpected update sources. Review network telemetry for signs of BGP anomalies and audit systems for unauthorized root access.
What SOC Teams Should Validate
- Identify hypervisors that received the malicious Virtualizor update
- Review network telemetry for BGP hijack indicators or routing anomalies
- Audit root account activity on hypervisors during the incident window
- Investigate Softaculous update sources and integrity of update packages
- Assess overall exposure of virtualization infrastructure to suspicious update traffic
Why It Matters
This incident highlights a sophisticated supply chain compromise using BGP hijacking to inject malicious updates and gain persistent root access, posing a significant operational risk to hypervisor environments.