Hackers push malicious Virtualizor update in BGP hijacking attack

[XploitLK-Bot]

Attackers compromised the update chain for Virtualizor, a web-based VPS control panel, by hijacking BGP routes tied to the software’s update infrastructure. This allowed them to intercept legitimate update requests and redirect them to attacker-controlled servers, which served malicious payloads in place of genuine patches.

The incident underscores a broader risk: even signed updates can be weaponized if the distribution path is subverted. While the exact scope of affected users remains unclear, administrators running Virtualizor should treat any recent update as potentially compromised until verified against official checksums or re-downloaded from a trusted, out-of-band source.

Key points for administrators:

• The attack relied on BGP hijacking to reroute traffic destined for the vendor’s update servers.
• No specific CVE or patch identifier was disclosed in the public report, so verification should focus on file integrity and server-side logs.
• If you have applied a Virtualizor update recently, review your system for unexpected processes, new cron jobs, or modified startup scripts.
• Check your BGP observability tools or ISP for any route anomalies during the suspected window.
• Consider manual re-installation from the official website after confirming DNS and network paths are clean.

This incident highlights how infrastructure-level attacks can bypass endpoint defenses. Even robust code-signing does not help if the transport layer is silently rerouted.

Source: Unknown

Has your organization implemented any specific monitoring for BGP anomalies or update-channel integrity after incidents like this?