Hackers pulled off a rare BGP hijacking to hand out malware disguised as routine software updates.
The attackers exploited weaknesses in the routing security setup at hosting provider Hetzner Online, plus gaps in the process for verifying who controls an IP address before a certificate authority issues a TLS certificate for it. That combination let them hijack a block of IP addresses assigned to Softaculous, a UAE-based company known for its web-software installer platform and for Virtualizor, a management tool for virtualized environments used by hosting providers and data centers. Softaculous used those same IPs to distribute updates and run its client and billing site. Once the attackers controlled the address space, they used it to serve malware dressed up as legitimate updates, though it is not confirmed whether Virtualizor's own update channel was compromised or only Softaculous's broader platform.
This is a supply chain attack aimed at the infrastructure layer, not end users browsing the web. Softaculous and Virtualizor sit inside hosting providers and data centers, so a single successful hijack can plant malware wherever those tools are trusted to auto-update. Getting a valid TLS certificate for hijacked IPs is the part that should worry defenders most, since that certificate is exactly what's supposed to prove nothing has gone wrong.
BGP hijacks are not new, and neither are rogue certificates, but pulling off both at once is a reminder that routing security and certificate issuance are still two separate systems, each assuming the other one caught the problem.