Hackers executed a supply-chain attack by seizing a block of internet addresses used to distribute updates for a widely used cloud management platform, spreading malware through what appeared to be legitimate software.
The attackers exploited weak routing security at hosting provider Hetzner Online and gaps in TLS certificate issuance to take control of IP addresses assigned to Softaculous. The United Arab Emirates-based company develops Virtualizor, a platform for managing virtualized environments. Those addresses deliver updates and host client and billing sites.
How the hijack unfolded
The attack involved a BGP hijacking that pulsed on and off over a 33-hour window. Hetzner Online reclaimed the address space 12 hours after the hijacking started by announcing the correct path. Then Hetzner Online stopped announcing the path, and the attacker executed the same hijack a second time. This time, it took Hetzner almost 10 hours to react. During that time, the hijack was active.
Softaculous warned in a Monday advisory that during the incident, a Virtualizor installation whose traffic was diverted could have received a malicious update package from the attacker’s server. Their product update clients did not yet verify update packages cryptographically, so a modified package would not have been rejected.
They could not determine exactly how many servers were affected but urged all Virtualizor users to check for signs of compromise.
Security lapses piled up
The attack succeeded due to a series of preventable mistakes. Hetzner Online’s RPKI configuration permitted sub-prefixes to be considered valid, allowing the attacker to bypass route origin validation. Normally, RPKI would block fraudulent announcements, but the forged path—with Hetzner’s AS number appended—made the hijack appear legitimate.
Related: First Drive of 2027 Range Rover Electric
Ben Cartwright-Cox, a BGP expert and creator of the BGP Tools suite, called the lapses “silly, preventable mistakes.”
Hetzner Online, Softaculous, and Zet.net did not respond to requests for comment. Nexon Host’s involvement remains unclear, though its infrastructure appears to have facilitated the malicious announcement.
BGP hijackings have been used in notable attacks before. While such incidents are becoming less frequent due to RPKI adoption, this attack demonstrates how a single misconfiguration can undermine those protections.
Softaculous has since added code signing to its update process, a basic security measure that would have blocked the malicious packages. The event highlights that even core internet protocols still depend on trust—and that trust is easily broken.
Cloud management platforms remain prime targets for such attacks, given their widespread use in enterprise environments.