Fake Virtualizor Update Sent Through Hijacked BGP Route Gives Attackers Permanent Root Access

According to a report from The Hacker News, a BGP hijack was used to deliver a malicious update for Virtualizor, a popular server management control panel. The attack resulted in persistent root access on affected systems. Understanding how this works requires a quick look at the Border Gateway Protocol, or BGP. BGP is the system that directs internet traffic between large networks, much like a postal sorting office decides which truck a package should take. When a network announces routes through BGP, other networks trust those announcements. In a hijack, an attacker sends false BGP announcements that divert traffic away from its intended destination. In this case, traffic meant for Virtualizor's update distribution was redirected to a server controlled by the attacker.

Virtualizor is a web-based control panel used by many hosting companies and server administrators to create, manage, and monitor virtual private servers. Because it sits at a highly privileged level, any update it receives is executed with extensive system permissions. The malicious update reportedly carried code that created a backdoor and gave the attackers persistent root access. Root access means full administrator control over a Linux server: the ability to read, change, or delete any file, install software, and create new accounts. Persistent means this access survives a reboot, so simply restarting the server does not close the backdoor.

BGP hijacking is not new, but using it to compromise software updates is particularly dangerous. Attackers can announce a more specific route to an IP address block, and because BGP was designed with trust rather than built-in authentication, many networks will accept the false information. Once traffic is diverted, the attacker can serve a modified version of the update file. Even if the update is downloaded over an encrypted connection, some administrators may not verify that the file's digital signature matches the vendor's official signature. This gap allows a tampered update to be installed as if it were legitimate. This kind of attack is known as a supply-chain attack, where a trusted update is tampered with before it reaches users.

For hosting providers and website owners, the impact can be severe. A compromised Virtualizor panel can give attackers control over all virtual servers running on the same physical machine. They could steal customer data, alter website content, install web shells, send spam, or use the servers for cryptocurrency mining and distributed denial-of-service attacks. Because the root access is persistent, the attacker may remain hidden for a long time. Reinstalling the server from scratch is often the only reliable way to remove such a deep compromise.

To defend against this type of supply-chain attack, organizations should verify software updates before applying them. This means checking cryptographic signatures or checksums published on an independent channel, such as the vendor's official website or support portal. Network operators can reduce BGP hijack risk by deploying Resource Public Key Infrastructure, or RPKI, which validates route announcements cryptographically. Server administrators should audit for unexpected root accounts, new SSH keys, or scheduled tasks that run after reboot. For infrastructure teams managing multiple servers or hosting customers, AEU-I's security-first IT and infrastructure consulting can help audit update pipelines and routing protections to reduce this kind of supply-chain risk.