According to an account from a hosting provider, 5 out of 34 Virtualizor hypervisors that were checked showed signs of root-level compromise. The malicious activity is believed to have occurred within a specific window, beginning around August 28 at 20:57 (exact end time not disclosed).

• The attack vector involved hijacking BGP routes to redirect Softaculous update traffic, rather than compromising the software repository directly.
• The delivered payload targeted Virtualizor installations, with the goal of maintaining stealthy, persistent administrative access.
• Hosting providers are advised to audit their Virtualizor hypervisors for unauthorized root access, especially if updates were applied during the incident window.

Since the exact scope of affected installations is not yet confirmed, immediate steps for administrators include:

• Reviewing system logs for any unauthorized SSH sessions or unexpected root-level commands during the specified timeframe.
• Checking for newly created user accounts or modified SSH authorized_keys files.
• Reinstalling or restoring Virtualizor from a verified, clean source if compromise is suspected.
• Rotating all root and administrative credentials across affected and potentially affected systems.

This incident underscores the risk inherent in relying on internet routing infrastructure for software updates, as a single BGP hijack can silently corrupt the trust chain of widely used management tools.

Source: The Hacker News

Has your team started auditing Virtualizor hypervisors for indicators of this attack, and what steps are you taking to verify the integrity of your current installations?