BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access
Attackers used a BGP hijack to divert Softaculous traffic and push a malicious Virtualizor update granting root persistence on some hypervisors.
Virtualizor reported that a BGP hijack between August 28 20:57 UTC and August 30 06:10 UTC diverted Softaculous update traffic to an attacker-operated server holding a valid Let's Encrypt certificate. Installations checking for updates during the window could receive a malicious package that added an attacker SSH key to root, created a proxyuser account, and installed a Java payload persisted via a systemd service. Hosting provider AlbaHost confirmed 5 of its 34 Virtualizor hypervisors were root-compromised. Virtualizor shipped Patch 9 with a Security Analyzer on September 1, but cryptographic package signing remains future work.
- Incident window: August 28 20:57 UTC to August 30 06:10 UTC; no affected-version range identified.
- Payload persisted via /etc/systemd/system/java-jre-update.service with C2 domains cdn.nerat.cc and connect.ne-rat.xyz.
- Operators told to run the official scanner, rotate API keys, and audit SSH keys, cron jobs, and users.
- Client-area users who logged in or entered payment details during the window should reset passwords and review statements.
- Victims
- AlbaHost
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdn.nerat.cc | le - /usr/local/virtualizor/zzvirtservice Injected string - cdn[.]nerat[.]cc/installer/widdow.jar Injected string - connect[.]ne-rat |
| domain | connect.ne-rat.xyz | g - cdn[.]nerat[.]cc/installer/widdow.jar Injected string - connect[.]ne-rat[.]xyz Injected string - jre-runtime.dat Command-and-control ( |
| ipv4 | 193.32.127.248 | assword-based Secure Shell (SSH) login to that account from 193.32.127[.]248 appeared in the provider's logs. In its examined environm |
| ipv4 | 31.77.220.138 | H source - 193.32.127[.]248 Provider-reported IP and port - 31.77.220[.]138:2025 Provider-reported marker - /tmp/.vz_svc_done Provide |
| sha256 | 73e74402b3a61c7bab289fc11347bd54c7fcdc2fa2e410f4c3de9d6cd7377d48 | n the official scanner , whose retrieved-script SHA-256 was 73e74402b3a61c7bab289fc11347bd54c7fcdc2fa2e410f4c3de9d6cd7377d48 when checked on September 2, 2026. Contact support before r |
| sha256 | b81a4e1fab9fc4e404d57224fe71e2c143aa93942bd46998789bdc944a7870c7 | oad - /usr/lib/jvm/.cache/jre-runtime.dat Payload SHA-256 - b81a4e1fab9fc4e404d57224fe71e2c143aa93942bd46998789bdc944a7870c7 Marker file - /usr/lib/jvm/.cache/.installed Marker file - |
From the original article
4 min read at thehackernews.com
Virtualizor said hackers used a Border Gateway Protocol (BGP) hijack to divert Softaculous traffic. The hackers then used the diverted update traffic to deliver a malicious Virtualizor package to some installations. A hosting-provider account separately said 5 of its 34 checked Virtualizor hypervisors sustained root-level compromise.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.