Attackers used a Border Gateway Protocol hijack to reroute internet traffic and deliver malicious software packages to Virtualizor installations, the virtualization platform disclosed in an incident advisory. The attack ran from roughly August 28 at 20:57 UTC through August 30 at 06:10 UTC, during which traffic intended for Softaculous services was redirected to a server under attacker control. One hosting provider reported that five of its 34 checked Virtualizor hypervisors suffered root-level compromise, though Virtualizor said the incident "affected a handful of servers rather than the general Virtualizor user base."
The attackers diverted update traffic for Softaculous services by announcing an unauthorized route that first appeared at 20:57:30 UTC on August 28, confirmed through RIPE Stat data. During the diversion window, the attackers obtained a valid Let's Encrypt certificate, meaning connections routed through the malicious server showed no certificate warnings. Any Virtualizor installation checking for updates during a diverted interval could receive the modified package, which the update client accepted because it lacked cryptographic package verification. The malicious code was inserted into three legitimate Virtualizor files and later executed through a root cron job. The injected payload added an attacker-controlled key to the root account, installed Java 17 if absent, downloaded a Java payload, and executed it as root. The payload established persistence via a systemd service and created an unauthorized account called "proxyuser," with successful password-based SSH login from 193.32.127[.]248 appearing in provider logs.
Virtualizor said every operator should check their servers because the company has no affected-version range or definitive list of installations that received the malicious package. The vendor released Patch 9 with a Security Analyzer on September 1, though it acknowledged that cryptographic package signing remained future work. Client-area sessions and payment-entry traffic during the diversion window may have reached the attacker-operated server, though as of September 2 the vendor had not reported confirmed theft of client-account or payment data. The hosting provider that examined its environment said it found no confirmed modification of customer virtual private servers and had not independently confirmed a database export.
The incident highlights the fragility of software supply chains that rely on network routing without cryptographic verification at the package level. Because Virtualizor's update client didn't verify package signatures, installations had no way to detect that the software came from an unauthorized source, even with valid SSL certificates masking the diversion. Operators should run the official scanner (SHA-256: 73e74402b3a61c7bab289fc11347bd54c7fcdc2fa2e410f4c3de9d6cd7377d48 when checked September 2), rotate all Virtualizor API keys, restrict API access to trusted IP addresses, audit SSH keys and scheduled tasks, and restrict SSH to trusted addresses. For hosts with confirmed root compromise, the AlbaHost provider said a clean rebuild is the only reliable long-term fix, since the scanner checks and contains known artifacts but doesn't guarantee removal of all attacker modifications. Virtualizor also advised client-area users who logged in or entered payment details during the incident window to reset passwords, change them anywhere reused, and review account activity and card statements.
The window between network-layer hijacks and application-layer defenses is narrowing as attackers exploit the trust assumptions built into legacy update mechanisms. Organizations running unverified software channels now face a choice between operational velocity and the overhead of signature validation at every layer.