BGP hijack delivers malicious Virtualizor updates

Operators of Virtualizor-based VPS platforms received malicious software updates after attackers hijacked the routing path for the control panel's update infrastructure. The incident demonstrates a rare but high-impact supply-chain vector targeting hosting automation tools.

What happened

Attackers performed a BGP hijack to redirect traffic intended for Virtualizor's official update servers to malicious endpoints under their control. When Virtualizor instances checked for updates, they instead downloaded and installed malware disguised as legitimate software. The source did not specify how long the hijack persisted or how many systems were affected.

Virtualizor, a web-based VPS management panel, is widely used by hosting providers to automate virtual server provisioning and administration. The attack did not compromise the software's source code or build process, but instead exploited the update delivery mechanism itself.

What we don't know yet

The source did not disclose the specific malware payload, the number of compromised systems, or whether the attackers targeted specific hosting providers. Timing of the attack remains unclear, as does the method used to gain initial access to the BGP routing infrastructure. No attribution to a known threat actor or group was provided.