An unknown group of attackers successfully carried out a supply chain attack by hijacking internet routing space belonging to Softaculous, a UAE-based company that develops cloud management platforms used by hosting providers and data centers. The attackers exploited multiple security lapses to redirect traffic and distribute malware disguised as legitimate software updates to customers using Softaculous’ Virtualizor platform.
The attack leveraged weaknesses in BGP (Border Gateway Protocol) routing security at hosting provider Hetzner Online and gaps in the TLS certificate acquisition process. By hijacking the IP address block 162.55.80.0/24, which hosted Softaculous’ software update endpoints and client billing site, the attackers were able to intercept and poison update packages. The incident unfolded over a 33-hour window with two separate hijacking episodes. Hetzner initially reclaimed the address space after 12 hours, but when it stopped announcing the correct route, the attackers executed the hijack a second time, taking Hetzner nearly 10 hours to respond.
A critical failure in Softaculous’ security practices contributed significantly to the attack’s success. The company had not implemented code signing to cryptographically verify software updates, meaning modified packages would not be rejected by client installations. Additionally, both Softaculous and downstream transit provider Zet.net failed to properly monitor their systems and did not detect the ongoing hijacking for 22 hours. BGP expert Ben Cartwright-Cox characterized the lapses as “silly, preventable mistakes.”
The attack demonstrates vulnerabilities in fundamental internet infrastructure. BGP, which routes traffic between autonomous systems and is essential to a unified global internet, historically operated on trust rather than validation. While security measures such as RPKI ROV (Route Origin Validation) were developed to prevent such hijacking, the attackers in this case crafted announcements that were technically RPKI-valid because Hetzner had configured its settings to allow the forged origin AS path to pass validation checks.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI