BGP Hijack Enables Malicious Virtualizor Update and Persistent Root Access

Introduction

In a sophisticated cyber incident reported recently, hackers exploited a Border Gateway Protocol (BGP) hijack to manipulate network routing and redirect legitimate traffic. This technique, commonly used by advanced threat actors, created a backdoor into virtualized environments hosted by Softaculous. The attack not only diverted existing traffic but also served as a covert delivery mechanism for a malicious software package designed to establish persistent administrative control over compromised systems.

The incident spanned approximately one hour, beginning around 20:57 on August 28, when security teams detected anomalous behavior within their networks. Investigations revealed that five out of 34 Virtualizor hypervisors across different deployments suffered from root-level compromise, demonstrating the potential scale and severity of such targeted attacks.

The BGP Hijack Mechanism

Border Gateway Protocol (BGP) is fundamental to the internet’s routing infrastructure, ensuring data packets take the most efficient paths between locations. When attackers perform a BGP hijack, they manipulate these routing tables to make other networks route traffic through controlled nodes under their command. In this case, the hijacked BGP announcements intercepted traffic destined for Softaculous cloud instances, effectively siphoning it to malware delivery channels.

• Attackers initially established their presence by altering BGP best-path records to misroute traffic toward a compromised relay node.
• The diverted traffic was not merely a passive interception; it was deliberately repurposed as a vector for payload distribution.
• This dual-use approach—simultaneously breaking network trust and installing malicious code—highlights the sophistication of modern botnet operations.

Delivery of the Malicious Virtualizor Package

Once the BGP hijack successfully rerouted traffic, the attackers leveraged the same compromised channel to push a specially crafted Virtualizor update. This update was disguised as a legitimate system patch, exploiting familiarity among administrators with virtualization platforms. Because many users rely on default update mechanisms, the malicious payload gained entry silently without triggering standard security alerts.

1. The update appeared benign to initial scrutiny due to its seemingly routine nature.
2. Upon installation, it granted elevated privileges to the host operating system.
3. Root-level access was subsequently established, enabling the attacker to maintain persistence and potentially escalate their activities further.

Impact and Detection Challenges

The scope of the breach was significant. Out of 34 monitored Virtualizor hypervisors, five exhibited clear signs of compromise—specifically, root-level privilege escalation that persisted after the initial exploitation attempt. Such deep penetration suggests that attackers may have been able to exploit vulnerabilities in the virtualization layer itself rather than relying solely on external network intrusion.

Detecting this type of threat requires comprehensive monitoring across both network perimeters and application-layer components. Traditional signature-based defense systems often miss zero-day or custom-built malware that mimics legitimate updates. This case underscores the importance of behavioral analytics and anomaly detection in securing multi-cloud and hybrid environments.

Broader Implications for Cloud Providers

For hosting providers and cloud service administrators, this incident serves as a cautionary tale about supply chain vulnerabilities in managed services. If a single virtualizer component is compromised, the blast radius extends across hundreds or even thousands of tenant environments. The reliance on automated update mechanisms makes organizations particularly vulnerable—if the update process itself is poisoned, the impact is amplified exponentially. This highlights the need for rigorous vetting of third-party software components and robust verification procedures before deployment in production environments.

Moreover, the incident emphasizes the growing convergence of network security and infrastructure protection. As BGP hijacks become more prevalent, defenders must treat network-level threats as part of the broader attack surface that includes container orchestration, virtual machine management, and API-driven integrations. Integrating threat intelligence feeds that correlate BGP anomalies with endpoint behaviors can provide early warning signals before compromise becomes critical.

Conclusion

In summary, the recent BGP hijack incident demonstrates how sophisticated attackers can weaponize legitimate network protocols to infiltrate virtualized infrastructures. By diverting traffic and using it to distribute a malicious update, adversaries achieved persistent root access on multiple Virtualizor hypervisors. While this particular breach affected only five out of 34 systems, the implications for organizational resilience are clear. Implementing proactive monitoring, regular patch management, and a Zero Trust framework can significantly reduce the likelihood of similar attacks successfully penetrating cloud environments. For those seeking to protect their digital assets, leveraging advanced AI-powered security solutions—such as those offered by Grivyonx Cloud—can provide real-time threat detection and automated response capabilities, helping to neutralize emerging risks before they escalate into full-blown breaches.