BGP Hijack Fuels Malicious Virtualizor Update, Granting Attackers Persistent Root Access

Security researchers have traced a recent supply‑chain compromise to a Border Gateway Protocol (BGP) hijack that rerouted traffic intended for Softaculous update servers. The intercepted stream was used to deliver a tampered Virtualizor package, which, when installed, gave threat actors lasting root privileges on affected systems.

In a BGP hijack, an adversary advertises illegitimate routing information, causing internet traffic to be redirected through networks under the attacker’s control. This manipulation can be brief or sustained, and it is difficult for end users to detect because the traffic appears to come from the legitimate destination.

Softaculous is a widely deployed script installer that automates the deployment of web applications on hosting platforms. Virtualizor, on the other hand, is a control panel that manages virtual private servers. Both tools are common in shared‑hosting environments, making them attractive targets for supply‑chain attacks that aim to reach many servers with a single malicious payload.

According to the investigation, the hijacked BGP route captured update requests from Softaculous clients. Instead of the authentic update files, the attackers supplied a crafted Virtualizor update that contained a hidden backdoor. Once the compromised package was applied, it established a persistent root‑level foothold, allowing the intruders to execute commands, exfiltrate data, or install additional malware at will.

Evidence of the intrusion emerged when a hosting provider voluntarily audited a sample of its installations. Out of 34 Virtualizor instances examined, five were found to be running the malicious update, confirming that the hijack had succeeded in reaching production environments.

Root access obtained through such a vector is especially dangerous because it bypasses typical privilege‑separation mechanisms. Attackers with this level of control can manipulate server configurations, harvest customer data, or pivot to other systems within the provider’s network, raising the stakes for both hosting companies and their end‑users.

Virtualizor’s developers have issued an advisory urging administrators to verify the integrity of their installations, apply any official patches, and monitor system logs for unusual activity. They also recommend that providers work with their upstream ISPs to confirm that BGP routes are correctly authenticated, reducing the likelihood of future hijacks.

The incident highlights a growing trend of infrastructure‑level attacks that exploit the trust placed in internet routing protocols. Experts point to the adoption of Resource Public Key Infrastructure (RPKI) and stricter route‑origin validation as essential defenses against similar threats.

As the cybersecurity community continues to analyse the breach, the focus remains on tightening supply‑chain safeguards and improving visibility into routing anomalies. Hosting operators are expected to increase monitoring of BGP announcements and to adopt multi‑layered verification for software updates, aiming to prevent a repeat of this hijack‑driven compromise.