Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Virtualizor users and hosting providers
Incident: BGP hijacking was used to deliver a malicious update package to Virtualizor hypervisors.
Impact: Attackers achieved persistent root access and created unauthorized system accounts on affected servers.
Attacker: Unidentified threat actors
Analysis: Threat actors manipulated routing tables to divert update traffic to a rogue server, leveraging a valid Let’s Encrypt certificate to avoid SSL warnings. Because the Virtualizor update client lacked cryptographic package verification, it accepted a modified package that established persistent root access. This incident underscores the systemic risk of relying on unverified update channels for critical infrastructure.
Recommendations: Run the official Virtualizor Security Analyzer to detect known malicious artifacts.; Rotate and restrict all API credentials to prevent unauthorized access.; Perform a clean rebuild of any hypervisor showing signs of root compromise or unauthorized users.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source