For two days, Virtualizor users experienced security breaches as malicious updates were distributed through a BGP hijacking. This incident, affecting Softaculous’ popular web-based VPS management tool, has raised significant concerns in the cybersecurity community.
Understanding the BGP Hijacking Attack
Between August 28 and August 30, a block of IP addresses belonging to Softaculous fell victim to a BGP hijack. This sophisticated attack allowed a threat actor to reroute internet traffic to their servers using a valid TLS certificate, misleadingly obtained for Softaculous domains.
The IP addresses under attack were crucial for various services, including software updates and client billing. Despite the targeted nature of this attack, it underscores the vulnerability of network systems to BGP hijacking exploits.
Impact on Virtualizor Users
Softaculous confirmed that a limited number of Virtualizor installations received a malicious update while their traffic was rerouted. Although this affected only a small portion of users, the potential for broader impact prompted Softaculous to urge all Virtualizor operators to examine their systems for signs of compromise.
The malicious traffic evaded company logs, complicating efforts to track the full extent of the breach. Consequently, Softaculous encourages users to take proactive measures, including resetting passwords and reviewing account activities.
Response and Mitigation Efforts
In the wake of the incident, Softaculous has released Virtualizor version 3.2.9.9 to address known vulnerabilities. This update includes a mitigation tool against exploits and plans to implement a code-signing mechanism to enhance package security.
The investigation into the attack continues, with Softaculous working diligently to ensure that no other products were compromised. The company has made available indicators of compromise (IoC) to assist users in identifying potential security breaches.
This incident highlights the critical importance of robust security measures and vigilant monitoring of network infrastructure to protect against sophisticated cyber threats.
