GoKawiilHackers delivered malicious updates to the Virtualizor VPS management software after hijacking BGP routing for its update infrastructure and redirecting update requests to malicious servers.
Virtualizor is a legacy web control panel from Softaculous that hosting providers use to create, sell, and manage virtual private servers (VPS).
An urgent notice from the vendor warns that between 20:57 UTC on August 28 and 06:10 UTC on August 30, an attacker rerouted a block of Hetzner-hosted IP addresses in a BGP (Border Gateway Protocol) hijacking attack.
This enabled the threat actor to divert traffic from Softaculous software update systems and the client/billing portal.
BGP hijacking occurs when a network operator falsely announces a route to IP addresses belonging to another organization. Other organizations may accept the fraudulent route as the preferred one.
An attacker receiving traffic this way can modify or redirect it to malicious destinations.
Softaculous says that the BGP hijacking allowed the hackers to deliver a malicious Virtualizor update to a small number of installations.
“We have confirmed that a malicious Virtualizor update package was delivered to a small number of installations that checked for updates while their traffic was being diverted,” the vendor says.
“This affected a handful of servers rather than the general Virtualizor user base.”
Because the requests were redirected to the attacker, the software vendor does not have logs. Softaculous recommends that Virtualizor operators check for the service:
... continue reading