The attack
Attackers hijacked BGP routing paths used by the Virtualizor VPS management software update infrastructure. By advertising more-specific routes, they redirected update traffic from legitimate Virtualizor servers to attacker-controlled hosts. VPS operators who had automatic updates enabled received trojanized packages during the attack window.
Why this is different from DNS poisoning
Most software update supply chain attacks target DNS: they compromise a DNS record to redirect download requests to a malicious server. BGP hijacking operates one layer below DNS, at the routing infrastructure level. It does not require compromising a domain registrar, DNS provider, or certificate authority. If the attacker's BGP advertisement is accepted by upstream peers, all traffic to the target IP prefix is redirected before DNS is ever consulted.
DNSSEC and HTTPS certificate validation are insufficient defenses against BGP-level redirection if the attacker also controls or compromises TLS termination for the redirected traffic.
Who is affected
Virtualizor is a commercial VPS management panel used by hosting providers and self-hosted VPS operators. The exact window of the BGP hijack and the number of affected installations have not been publicly disclosed. Operators running Virtualizor with automatic updates enabled during the attack window should treat their management panel as potentially compromised.
What to do
- Disable automatic updates for Virtualizor until the vendor confirms the update infrastructure is clean.
- Verify the integrity of the currently installed Virtualizor version against the vendor's published checksums.
- If you auto-updated during the suspected attack window, treat the host as potentially compromised and audit running processes, scheduled tasks, and network connections.
The durable lesson
Software update security cannot rely solely on TLS and DNS integrity. Organizations with critical infrastructure should validate software updates against cryptographic signatures published through independent channels, implement RPKI route origin validation where possible, and treat BGP hijacking as a real threat model for critical software supply chains.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss BGP security or software supply chain risk for your infrastructure.