A recent security incident involving Virtualizor has come to light, where hackers exploited a Border Gateway Protocol (BGP) hijack to intercept Softaculous traffic. This diversion allowed attackers to distribute a malicious update to some Virtualizor installations, leading to root-level compromises in several systems. Notably, a hosting provider has reported that five of its 34 examined Virtualizor hypervisors were affected.
Incident Details and Timeline
The unauthorized activities were detected between August 28 at 20:57 UTC and August 30 at 06:10 UTC. Virtualizor has urged all operators to inspect their servers since an exhaustive list of affected installations or versions remains unavailable. To address the situation, Virtualizor issued Patch 9 with a Security Analyzer on September 1, although cryptographic signing of packages is still a work in progress. Operators are advised to utilize the official scanner, update API credentials, and thoroughly audit servers for any unauthorized access or persistence.
Technical Aspects of the Attack
The BGP hijack resulted in traffic redirection to servers controlled by the attackers. These servers acquired a valid Let’s Encrypt certificate, preventing any certificate warnings during connections. Virtualizor installations that checked for updates during this period might have received the tampered package due to the absence of cryptographic verification mechanisms. AlbaHost, a provider on LowEndTalk, revealed that malicious commands were embedded in legitimate Virtualizor files, executed later via a root cron job.
Key modifications included the addition of an attacker-controlled key to the root account and the installation of Java 17 if missing, followed by the execution of a payload as root. This payload created persistence using a systemd service and established an unauthorized account called ‘proxyuser’. Anomalies were noted with SSH logins from an IP address linked to the attackers.
Recommendations for Virtualizor Operators
Virtualizor has outlined several steps for operators to secure their systems. These include checking for specific systemd units, rotating API keys, auditing unknown SSH keys, and restricting access to trusted IPs. The official scanner, which has a specific SHA-256 hash for verification, should be employed to identify indicators of compromise (IoCs). Operators are advised to contact support before taking remediation actions to preserve evidence.
Some IoCs include the presence of specific files and injected strings in core Virtualizor files. If a root compromise is confirmed, a complete system rebuild is recommended for long-term security.
Future Outlook and Security Measures
As investigations continue, Virtualizor emphasizes the need for vigilance and comprehensive server audits. While no client data theft has been confirmed, users who logged in or entered payment details during the incident should take precautionary measures, such as changing passwords and reviewing account activity. Virtualizor’s ongoing inquiry aims to provide further clarity and enhance security measures to prevent similar breaches in the future.
