BGP hijacking campaign abuses routing and TLS weaknesses to push malware via software updates

A coordinated campaign hijacked a /24 IP block (162.55.80.0/24) used by Softaculous, a UAE-based provider of software installation and virtualization management platforms, to push malware disguised as software updates. The attackers exploited misconfigurations in the Border Gateway Protocol (BGP) routing security and weaknesses in TLS certificate issuance to seize control of the IP space from Softaculous’ hosting provider, Hetzner Online.

The hijack began just before 9 PM UTC on a Friday, when a new route for the Softaculous IP prefix was announced through AS62390 (Nexon Host) and AS6204 (Zet.net) into AS24940 (Hetzner Online). The forged route included a legitimate origin AS (24940) and a sub-prefix (/24) that Hetzner’s RPKI configuration allowed, bypassing RPKI protections. According to BGP expert Doug Madory, the announcement likely originated from Nexon Host, either via a compromised infrastructure or a customer exploiting gaps in its security.

Hetzner Online regained control of the hijacked space within 12 hours, but the attackers re-executed the hijack less than 10 hours later, and Hetzner took nearly 10 hours to respond the second time. During the 33-hour window, the hijack pulsed on and off for much of the weekend. Neither Hetzner Online, Softaculous, nor Zet.net detected the hijack for at least 22 hours, despite failures to monitor their systems properly.

Softaculous acknowledged that its Virtualizor update clients did not cryptographically verify update packages during the incident window. As a result, a modified package from the attacker’s server would not have been rejected automatically. The company warned that a small number of servers may have received malicious updates and urged operators to treat every Virtualizor server as in scope for checks.

BGP expert Ben Cartwright-Cox characterized the lapses as "silly, preventable mistakes," noting that overly permissive RPKI configuration at Hetzner Online allowed the hijacked route to appear RPKI-valid. The incident demonstrates how attackers can abuse sub-prefix announcements and forged AS paths to bypass RPKI protections when RPKI is not configured with strict prefix-length constraints.