Latest BGP hijack targets hosting software vendor
RPKI-valid BGP hijack plus fraudulent TLS certificate delivered a malicious Virtualizor update to Softaculous customers, APNIC analysis shows.
Attackers announced a more-specific 162.55.80.0/24 covering Softaculous's update endpoint, apparently via NexonHost (AS62390), with a forged AS24940 origin that passed RPKI validation and beat Hetzner's legitimate 162.55.0.0/16 route. Using the hijack, they obtained a technically valid TLS certificate by controlling the CA validation quorum, then served a malicious Virtualizor update to a small number of installations. Hetzner countered by announcing the /24, and the incident mirrors the 2022 KLAYswap and Celer Bridge BGP-PKI attacks.
- More-specific /24 hijack of Hetzner's 162.55.0.0/16 via forged origin
- Route was RPKI-valid, so RPKI-invalid filtering offered no protection
- Valid TLS cert obtained by controlling multi-perspective CA validation quorum
- Malicious Virtualizor update delivered to a small number of installations
- Echoes 2022 KLAYswap and Celer Bridge routing/PKI attacks
From the original article
8 min read at blog.apnic.net
Just days ago, a Border Gateway Protocol (BGP) hijack was used as part of an attack on hosting software vendor Softaculous Ltd, the company behind the Softaculous auto-installer and the Virtualizor VM management platform.
By blog.apnic.net via fanf · blog.apnic.net
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.