The Invisible Attack: How BGP Hijacking Threatens Your Server Infrastructure

A recent security incident has sent ripples through the web hosting community. Attackers successfully hijacked BGP routes to target Softaculous, a popular hosting automation platform, and its subsidiary Virtualizor. The goal? Obtain fraudulent TLS certificates and inject malicious updates into software distribution channels. This isn't just another security headline—it's a wake-up call for everyone running infrastructure on the internet.

What Exactly Happened?

The attack followed a disturbingly sophisticated playbook:

1. Route Hijacking: Attackers announced BGP prefixes they didn't own, redirecting traffic meant for specific IP addresses through their infrastructure
2. Certificate Fraud: By intercepting legitimate traffic, they obtained TLS certificates from Let's Encrypt for domains they didn't control
3. Malicious Updates: With valid certificates, they served compromised Virtualizor updates to customers

This sequence is particularly alarming because each step enabled the next. The BGP hijack made everything else possible.

Understanding BGP: The Internet's GPS

BGP (Border Gateway Protocol) is essentially the internet's routing system. When you request data from a server, BGP determines the path that traffic takes across thousands of networks. It's been described as the internet's GPS, but unlike your car's navigation, BGP relies entirely on trust.

Networks announce which IP addresses they control, and other networks believe them. There's no built-in verification mechanism. This trust-based model worked fine when the internet was a small academic network, but today it's a significant vulnerability.

Why Should Developers Care?

You might think BGP security is an issue for network engineers, not application developers. Think again.

Every time you deploy to a server, update a dependency, or install control panel software, you're trusting the delivery mechanism. If that mechanism is compromised through BGP hijacking, your entire infrastructure could be running compromised code.

The Softaculous attack demonstrates that attackers can:

• Bypass certificate validation that developers rely on for secure connections
• Distribute malware through trusted update channels that appear legitimate
• Compromise servers at the infrastructure level, before any application code even runs

RPKI: A Light in the Darkness

The good news? Solutions exist. Resource Public Key Infrastructure (RPKI) is a framework that adds cryptographic validation to BGP announcements. With RPKI, networks can verify that they actually own the IP prefixes they announce.

When properly implemented, RPKI prevents route hijacking by making it impossible for attackers to announce prefixes they don't own. Major cloud providers and network operators are increasingly adopting RPKI, but the ecosystem isn't complete yet.

Here's what you should know:

• RPKI validation catches most accidental route leaks and prevents malicious hijacks
• Deployment is growing but not universal—many smaller networks still lack protection
• It's a network-level solution, meaning you depend on your hosting provider's infrastructure

Protecting Your Infrastructure

While you can't single-handedly fix BGP, you can take steps to reduce your exposure:

For Your Hosting Choice

• Select providers with strong network security: Look for RPKI implementation, route origin validation (ROV), and transparent routing policies
• Verify provider certifications: Check if your hosting company undergoes security audits
• Ask about their BGP security posture: Reputable providers should be able to explain their RPKI and security measures

For Your Code

• Verify checksums independently: Don't rely solely on HTTPS for software verification
• Use reproducible builds when possible to verify software integrity
• Implement code signing for your own deployments

For Certificate Validation

• Use Certificate Transparency logs: Monitor for unexpected certificates issued for your domains
• Implement HSTS: Force HTTPS connections and reduce attack surface
• Consider certificate pinning for critical infrastructure connections

The Bigger Picture

The Softaculous incident isn't an isolated event. Similar BGP hijacks have targeted cryptocurrency exchanges, major cloud providers, and content delivery networks. The technique is becoming more sophisticated, and the potential impact grows as more infrastructure moves to the cloud.

This attack also highlights the interconnected nature of internet security. A vulnerability in routing infrastructure can undermine the strongest application-layer protections. TLS certificates, which we trust implicitly, become weapons in the wrong hands.

What's Next?

The web hosting industry needs to prioritize BGP security as a fundamental requirement, not an optional enhancement. At NameOcean, we're committed to working with providers who take infrastructure security seriously.

For developers and startups, this incident is a reminder that security extends far beyond your application code. Understanding the infrastructure stack beneath your software isn't just for ops teams anymore—it's essential knowledge for anyone responsible for digital assets.

Stay vigilant, verify your sources, and choose hosting partners who invest in comprehensive security measures. The attackers are getting more sophisticated. Your defenses should be too.

The good news is that the security community is actively working on solutions. RPKI adoption is accelerating, and tools for monitoring BGP security are improving. But until these protections become universal, staying informed and choosing security-conscious providers remains your best defense.

What steps are you taking to verify the integrity of your infrastructure? We'd love to hear your approach to managing these emerging security challenges.