Attackers hijacked Softaculous update IPs via Hetzner routing lapses to push malware without code signing checks

The event details a supply chain attack where unknown actors used a BGP hijack to deliver malware masquerading as software updates. Attackers exploited weaknesses in the routing security of Hetzner Online to gain control over IP addresses assigned to Softaculous. Softaculous used these specific IPs to issue updates for Virtualizor, a management platform for virtualized environments. By controlling the address space, the attackers could push malicious packages to unsuspecting users.

The success of the attack hinged on a series of preventable failures across multiple organizations. Hetzner Online's lax routing configuration allowed the initial hijack, and their delayed response enabled a second hijack after they initially reclaimed the space. Softaculous failed to implement code signing, meaning their update clients did not cryptographically verify packages, allowing modified packages to be accepted. Furthermore, both Softaculous and transit peer Zet.net failed to monitor their systems adequately, leaving the hijack active for 22 hours before detection.

The scope of the compromise remains uncertain, creating operational challenges for affected engineers. Softaculous warned that any Virtualizor installation with diverted traffic during the incident window could have received a malicious update. Although the company believes only a small number of servers were affected, they cannot produce a definitive list. Consequently, operators must treat every Virtualizor server as potentially in scope for compromise checks.

Adopting standard security measures would have prevented this attack at multiple stages. Deploying RPKI ROV, which uses cryptographic records to validate route origins, would have allowed networks to reject the invalid BGP announcements. Implementing code signing for update packages would have caused client systems to reject the malicious payloads. The attack demonstrates that failing to combine routing security with software integrity validation leaves infrastructure vulnerable to targeted supply chain compromises.