Cybersecurity Threats Take a Sophisticated Turn as BGP Hijack Allows Malicious Update of Virtualizor with Persistent Root Access
A recent and disturbing incident has highlighted the continued threat posed by cyber attacks on critical infrastructure, as hackers successfully exploited a Border Gateway Protocol (BGP) hijacking to inject malicious code into the Virtualizor control panel. This has allowed them to establish persistent root access, giving them complete control over affected systems. The implications are severe, with experts warning of widespread damage and compromised data.
The attack was carried out through a BGP hijack, which involves exploiting vulnerabilities in network routing protocols to intercept traffic and inject malicious code. In this case, the hackers targeted the Virtualizor control panel, a web-based management interface for servers. By injecting malware into this tool, they were able to gain elevated privileges and establish persistent root access to affected systems.
The hackers exploited a weakness in the way BGP routing protocols operate, allowing them to intercept traffic destined for the targeted network. They then injected malicious code into the Virtualizor control panel, which was used by administrators to manage servers. This allowed them to carry out actions with superuser privileges, essentially giving them unfettered access to affected systems.
The attack has significant implications for organizations that rely on Virtualizor for server management. The persistence of the root access granted by the malware means that hackers can remain undetected and continue to carry out malicious activities even after the initial infection is discovered. This highlights the importance of robust security measures, including regular updates, monitoring, and incident response planning.
The use of BGP hijacking as an attack vector also underscores the need for improved network routing security measures. While BGP hijacks are relatively rare, they can have devastating consequences when successful. Experts recommend that organizations implement additional security protocols to mitigate these risks, such as AS Path filtering and route origin verification.
As a result of this incident, it’s clear that cyber threats continue to evolve in sophistication, requiring organizations to remain vigilant and proactive in their defense strategies. In the face of ongoing attacks like this one, it’s essential for administrators to stay up-to-date with the latest security patches and best practices to prevent similar incidents from occurring.
To protect against such sophisticated attacks, we recommend that all Virtualizor users implement robust authentication measures, monitor system logs regularly for suspicious activity, and maintain up-to-date software and configurations. This will help ensure that your systems remain secure in the face of evolving cyber threats.
Source: The Hacker News — 2026-09-02