BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access

A BGP hijack was used to redirect traffic, allowing hackers to deliver a malicious Virtualizor update. This update gave the attackers persistent root access to some installations. A hosting provider reported that 5 out of 34 of its Virtualizor hypervisors were compromised at the root level. The hijack and subsequent malicious update delivery occurred during a specific incident window starting around August 28 at 20:57. The attack was carried out by diverting Softaculous traffic through the BGP hijack. The hackers took advantage of this diversion to push the malicious Virtualizor package to affected systems.