The BGP Hijack That Turned a Routine Software Update Into Malware

Table of Contents

1. A 32-Hour Window Nobody Noticed
2. What Virtualizor Actually Is—and Why It Was a Good Target
3. How You Hijack the Internet's Own Map
4. The Certificate Trick That Made It Look Legitimate
5. What Actually Landed on Compromised Servers
6. AlbaHost's Numbers Put a Face on the Damage
7. Why BGP Hijacks Are So Hard to Catch in Real Time
8. What Virtualizor Did After Discovery
9. Why This Is Fundamentally a Networking Story
10. Build These Skills—Innovative Academy
11. Final Thoughts

There's a kind of attack that skips every layer of security most IT teams invest in—no phishing email, no stolen password, no exploited application bug—and instead goes straight for the plumbing that decides how traffic finds its way across the internet.

That's what happened to Virtualizor over a roughly 32-hour window in late August 2026, when attackers hijacked the routing protocol underlying the internet to slip malware into what looked like an ordinary software update.

1. A 32-Hour Window Nobody Noticed

At 20:57:30 UTC on August 28, 2026, an attacker announced an unauthorized route for the IP block 162.55.80.0/24—the address space hosting Softaculous's official update infrastructure, the company behind Virtualizor.

For the next day and a half, until the hijack ended around 06:10 UTC on August 30, any server pulling a routine Virtualizor update was quietly redirected to an attacker-controlled server instead of the real one.

No error message, no broken connection—just a normal-looking update arriving from the wrong place.

2. What Virtualizor Actually Is—and Why It Was a Good Target

Virtualizor is virtualization management software hosting providers use to run their hypervisor infrastructure—spinning up virtual private servers and handling the backend of shared and cloud hosting environments.

It's made by Softaculous, also behind products like Webuzo, Backuply, and SitePad.

Virtualizor sits at the administrative core of hosting infrastructure that, in turn, hosts other people's websites and data. That means compromising its update pipeline doesn't just compromise one server—it potentially compromises every server trusting that channel.

3. How You Hijack the Internet's Own Map

BGP (Border Gateway Protocol) is the mechanism that tens of thousands of independently operated networks use to tell each other, "Traffic for this address block should come through me."

It's a constantly updated, distributed map that, by design since the early internet, runs largely on trust.

Any network operator with the right access can announce it's the correct path to a block of IP addresses, and unless something is actively checking that announcement against reality, other networks will often just believe it.

That's precisely what happened here: the attacker announced a route for Softaculous's own address block, and enough of the internet believed it long enough to redirect real update traffic to a server the attacker controlled.

For anyone building a career in networking, understanding routing fundamentals is essential. You can explore CCNA Training in Bangalore to build practical knowledge of routing, switching, network security, and troubleshooting.

4. The Certificate Trick That Made It Look Legitimate

A hijacked route alone usually isn't enough to fool a system checking for a valid HTTPS certificate.

The attacker closed that gap by obtaining a valid Let's Encrypt TLS certificate for the hijacked domain—since Let's Encrypt verifies domain control through automated checks that were, at that moment, also being routed through the hijacked path.

The update traffic wasn't just redirected; it arrived wrapped in the same padlock-icon reassurance a real update would have carried.

5. What Actually Landed on Compromised Servers

Once a server pulled the poisoned update, the payload modified three legitimate Virtualizor files and installed persistence mechanisms designed to survive a reboot.

Investigators found a Java 17 runtime installed to run a malicious JAR payload. The JAR payload was pulled from cdn.nerat.cc/installer/widdow.jar.

A new unauthorized system account named proxyuser was created, along with a disguised systemd service named java-jre-update.service.

SSH logins tied to the operation were traced to 193.32.127.248.

Given Virtualizor's role managing hosting environments, attackers may have had a path to client-area sessions and payment data, though no confirmed data theft had been reported at the time the advisory was published.

6. AlbaHost's Numbers Put a Face on the Damage

AlbaHost, a hosting provider, confirmed that 5 of the 34 Virtualizor nodes it checked were compromised during the hijack window—roughly one in seven.

Virtualizor itself characterized the incident as affecting "a handful of servers rather than the general Virtualizor user base," which may be accurate in aggregate.

However, a 32-hour hijack against update infrastructure used across a large hosting ecosystem means the actual blast radius likely extends well beyond any single provider's own audit.

AlbaHost only caught the compromise because it went looking proactively—a reminder that the true scale of an incident like this depends heavily on how many affected organizations actually check, rather than assume they were spared.

7. Why BGP Hijacks Are So Hard to Catch in Real Time

Part of what makes this style of attack effective is how invisible it is while happening.

There's no malware signature to flag, no phishing link to report—from the affected server's perspective, an update simply arrived the way updates always do.

Detecting a BGP hijack in real time generally requires actively monitoring route announcements against what's expected.

RPKI (Resource Public Key Infrastructure) validation and route monitoring services exist specifically for these purposes, but a large share of networks still don't have this capability wired into their operational alerting.

That's exactly why a 32-hour hijack could run its full course before being widely noticed.

Pinning update sources to verified, monitored infrastructure and treating unexpected certificate reissuance as a signal worth investigating, rather than routine noise, closes at least part of the gap that let this specific attack pass as legitimate.

8. What Virtualizor Did After Discovery

To its credit, Virtualizor moved with real urgency once the hijack was identified.

On September 1, it released Patch 9, including a built-in security analyzer to help administrators check their systems for indicators of compromise.

The company published a full advisory on September 2, recommending affected administrators run the official scanner, rotate all API credentials, audit for unauthorized account activity, and—for confirmed compromises—perform a clean rebuild rather than simply removing malicious files.

An attacker with root-level persistence for over a day had ample opportunity to plant additional backdoors, making a clean rebuild a much safer response for confirmed compromises.

9. Why This Is Fundamentally a Networking Story

It's tempting to file the incident under "software supply chain attack," but the mechanism that made everything else possible was pure routing.

Nothing about Virtualizor's code was flawed—the flaw was in the trust model underlying how the internet decides which network carries traffic for a given address block.

That's core networking territory: understanding what BGP announces, why routes can be hijacked, what RPKI does to close that gap, and how to read a routing anomaly like the one that ran for a day and a half here.

An administrator who understands routing at this level notices something is wrong far sooner than one who only thinks about security at the application layer.

If you're building your networking foundation, Innovative Academy's Networking Fundamentals Training in Bangalore covers core networking concepts, routing, switching, network services, troubleshooting, and hands-on lab scenarios.

10. Build These Skills—Innovative Academy

Understanding BGP, routing protocols, and the trust assumptions baked into how networks talk to each other is foundational networking knowledge that becomes directly relevant the moment an incident like this happens.

Innovative Academy's CCNA Training in Bangalore focuses on routing, switching, network security fundamentals, Cisco technologies, and practical troubleshooting through hands-on labs.

The program includes practical networking scenarios designed to help learners move beyond memorizing commands and understand how real infrastructure behaves.

For learners looking to expand from networking into cloud infrastructure, the academy also offers programs covering Networking, Cloud, DevOps and other IT technologies.

11. Final Thoughts

What makes this incident worth remembering isn't its complexity—it's almost old-fashioned as internet attacks go, exploiting a trust assumption baked into BGP's design long before most current security tooling existed.

The attackers needed little beyond patience and technical fluency: no zero-day in Virtualizor's code, no phishing campaign, no stolen credentials—just a well-timed route announcement, a legitimately issued certificate, and a day and a half of nobody noticing.

Security conversations tend to gravitate toward application vulnerabilities because those incidents make headlines most often, but the routing fabric underneath is just as capable of being the point of failure.

It is also frequently the layer with the least active monitoring relative to how much depends on it.

Learning to read routing behavior isn't a specialist skill reserved for backbone engineers anymore. It's becoming a baseline expectation for anyone responsible for infrastructure other people depend on.

This Virtualizor incident is a powerful reminder that cybersecurity doesn't stop at applications, endpoints, or passwords. Sometimes, the most important security control is understanding how the network itself decides where traffic should go.

Want to build that networking foundation? Explore Innovative Academy's CCNA Training and develop practical skills in routing, switching, network security, and troubleshooting.