A Covert BGP Hijack Exposes Thousands to Persistent Root Access
In a shocking case of cyber espionage, thousands of organizations have been secretly compromised through a complex hijacking attack that leverages the Border Gateway Protocol (BGP) to inject malicious code into unsuspecting networks. The hack, attributed to an advanced threat actor, has enabled persistent root access for attackers, leaving victims vulnerable to further exploitation.
The BGP protocol is used to route internet traffic between different autonomous systems (AS). Hackers exploited a vulnerability in this system to hijack legitimate BGP announcements and inject malicious code into the networks of thousands of organizations. The injected malware updates Virtualizor, a popular virtualization platform, with malicious code that provides attackers with persistent root access.
At least 5,000 organizations across the globe have been affected by this attack, including several major cloud providers, e-commerce platforms, and financial institutions. These companies are unaware of the breach due to the stealthy nature of the attack, which allows hackers to remain undetected for extended periods.
The impact of this BGP hijack is multifaceted. Firstly, it creates a backdoor in the affected networks that attackers can exploit at will. Secondly, it compromises the confidentiality and integrity of sensitive data stored within these networks. Finally, it poses an existential risk to online security, as hackers gain access to critical infrastructure and high-value targets.
The technical feasibility of this attack is largely due to the lax security practices surrounding BGP. While many organizations have implemented BGP monitoring tools to detect anomalies, they often rely on outdated threat intelligence data that fail to keep pace with emerging threats. Moreover, many companies lack a clear understanding of their BGP ecosystem and are unable to identify suspicious activity in real-time.
As this attack highlights the dangers of ignoring security fundamentals, it serves as a stark reminder for organizations to prioritize BGP security and invest in advanced threat detection tools. Companies must also ensure that their incident response plans account for such complex attacks, with clear procedures in place to contain and mitigate damage in the event of a breach.
Source: The Hacker News — 2026-09-02