Posted on

Virtualizor – Malicious Update Delivery Through BGP Hijacking

Threat Overview

Softaculous confirmed a supply-chain incident in which an attacker hijacked BGP routing for 162.55.80.0/24, a Hetzner-hosted address block serving Softaculous infrastructure, between approximately 20:57 UTC on August 28 and 06:10 UTC on August 30, 2026. The attacker obtained a valid TLS certificate and redirected update and client-area traffic to attacker-controlled infrastructure.

Softaculous confirmed that a malicious Virtualizor update package was delivered to a small number of installations that checked for updates while traffic was diverted. Because the malicious responses did not traverse Softaculous systems, the vendor cannot produce a definitive affected-server list and directs Virtualizor operators to validate their systems.

The vendor-confirmed IOC is /etc/systemd/system/java-jre-update.service, including an enabled or running java-jre-update service. Follow-up validation should include SSH keys, accounts, scheduled tasks, systemd persistence, and unexpected outbound communications.

References

Impacted Systems

  • Vendor/product: Softaculous Virtualizor VPS management platform.
  • Platform: Linux virtualization and VPS management servers.
  • Incident window: August 28, 2026 20:57 UTC through August 30, 2026 06:10 UTC.
  • Hijacked address block: 162.55.80.0/24.
  • Exposure condition: Virtualizor installations that checked for updates while traffic was diverted.
  • Confirmed IOC: /etc/systemd/system/java-jre-update.service.
  • Confirmed scope: the vendor says a small number of Virtualizor installations received the malicious package, but it cannot identify every affected server.
  • Other Softaculous products were not identified as receiving malicious packages at the time of the advisory.

Why this matters

This is confirmed malicious software-update delivery through Internet routing manipulation. Virtualization management systems are highly privileged and can expose hosted workloads, administrative credentials, and infrastructure control if compromised.

Exploitation Status

Confirmed malicious update delivery. Softaculous states that a malicious Virtualizor package reached a small number of installations during the BGP hijack. The exact victim list is not available to the vendor.

What this hunt looks for

The confirmed malicious systemd service, related process execution, new SSH authorized keys, systemd and cron persistence, suspicious account creation, download-and-execute behavior, and new outbound destinations from virtualization hosts.

Required logs

  • DeviceFileEvents
  • DeviceProcessEvents
  • DeviceNetworkEvents
  • Syslog

Hunt 1 – First-Pass: Confirmed Virtualizor Malicious Service IOC

DeviceFileEvents
| where TimeGenerated >= ago(14d)
| where FileName =~ "java-jre-update.service"
| where FolderPath =~ "/etc/systemd/system/java-jre-update.service"
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 2 – Systemd Activity for java-jre-update

Syslog
| where TimeGenerated >= ago(14d)
| where SyslogMessage has "java-jre-update"
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc

Hunt 3 – Process Execution Related to the Malicious Service

DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where ProcessCommandLine has "java-jre-update" or InitiatingProcessCommandLine has "java-jre-update"
| project TimeGenerated, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Hunt 4 – New SSH Authorized Keys on Virtualization Hosts

DeviceFileEvents
| where TimeGenerated >= ago(14d)
| where FileName =~ "authorized_keys"
| where ActionType in ("FileCreated","FileModified","FileRenamed")
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 5 – New or Modified Systemd and Cron Persistence

DeviceFileEvents
| where TimeGenerated >= ago(14d)
| where ActionType in ("FileCreated","FileModified","FileRenamed")
| where FolderPath has_any ("/etc/systemd/system/","/etc/cron.d/","/etc/cron.daily/","/var/spool/cron/")
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Hunt 6 – New Public Destinations From Virtualization Hosts

let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(7d))
| summarize by DeviceId, RemoteIP, RemotePort;
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where RemoteIPType == "Public"
| join kind=leftanti Baseline on DeviceId, RemoteIP, RemotePort
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Processes=make_set(InitiatingProcessFileName,20), Commands=make_set(InitiatingProcessCommandLine,20) by DeviceName, RemoteIP, RemoteUrl, RemotePort
| sort by FirstSeen desc

Hunt 7 – Suspicious Account Creation on Linux Hosts

Syslog
| where TimeGenerated >= ago(14d)
| where SyslogMessage has_any ("useradd","adduser","new user","new group","passwd")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc

Hunt 8 – Suspicious Download and Execution on Linux Virtualization Hosts

DeviceProcessEvents
| where TimeGenerated >= ago(14d)
| where FileName in~ ("curl","wget","bash","sh","python","python3","chmod","systemctl")
| where ProcessCommandLine has_any ("/tmp/","/var/tmp/","systemd/system","java-jre-update","curl ","wget ","chmod +x","systemctl enable")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated asc

Detection Notes

  • The confirmed service path is the highest-fidelity IOC from the vendor.
  • Absence of the service does not prove a server was unaffected if artifacts were removed or changed.
  • SSH keys, accounts, cron jobs, and systemd units require administrative-context validation.
  • New-destination baselining can be noisy on hosting infrastructure.
  • Defender Device* coverage on Linux is not universal. Syslog may be the only available host telemetry.
  • Retrospective detection of the BGP event requires relevant network, DNS, endpoint, or host telemetry from the incident window.

Leave a comment