BGP hijack turns software update channel into malware delivery vector

Attackers hijacked IP address blocks belonging to Softaculous by exploiting routing misconfigurations at Hetzner Online and weak TLS certificate validation. They then used those addresses to distribute malicious updates disguised as legitimate software, targeting Virtualizor management platforms. The incident was compounded by Softaculous's failure to cryptographically sign update packages, leaving affected servers without a reliable way to detect tampering.

The attack unfolded in two distinct hijack phases over a 33-hour window, with Hetzner Online reclaiming the address space after the first 12-hour incident, only for the attacker to repeat the hijack once Hetzner stopped announcing the correct path. The second phase persisted for nearly 10 hours before a response. Monitoring failures at Softaculous, Hetzner, and transit peer Zet.net allowed the compromise to continue for roughly 22 cumulative hours before detection. BGP expert Ben Cartwright-Cox characterized the lapses as "silly, preventable mistakes," noting that Nexon Host's infrastructure may have inadvertently facilitated the malicious route announcement. The incident underscores how BGP's trust-based architecture remains vulnerable when operators neglect basic route filtering and validation practices.