BGP Hijacking Incident Affects Hosting Networks
A coordinated cyberattack exploited vulnerabilities in BGP routing and TLS certificate issuance, impacting networks using cloud management software.
A significant cyberattack has compromised networks by hijacking a portion of internet infrastructure used for software updates. The attackers exploited weaknesses in the routing security of hosting provider Hetzner Online and the process for obtaining valid TLS certificates.
The operation involved a BGP (Border Gateway Protocol) hijacking, which allowed attackers to gain control over IP addresses assigned to Softaculous, a company that provides web software installation and management platforms. Softaculous also develops Virtualizor, a platform for managing virtualized environments.
Attackers used the hijacked IP addresses to distribute malware disguised as software updates. This supply chain attack targeted users of cloud management software provided by Softaculous, affecting hosting providers, data centers, and other large infrastructure companies.
The incident highlights ongoing security challenges in internet routing and certificate management, underscoring the need for enhanced BGP security measures and more robust certificate issuance protocols to prevent future malicious activities.