{"id":34283,"date":"2026-09-10T16:02:16","date_gmt":"2026-09-10T16:02:16","guid":{"rendered":"https:\/\/blog.lacnic.net\/?p=34283"},"modified":"2026-09-10T16:02:32","modified_gmt":"2026-09-10T16:02:32","slug":"bgp-hijack","status":"publish","type":"post","link":"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/","title":{"rendered":"Latest BGP Hijack Targets Hosting Software Vendor"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">BY <a href=\"https:\/\/www.kentik.com\/blog\/author\/doug-madory\/\"><strong>Doug Madory<\/strong><\/a>Director of Internet Analysis at KentiK<br><br>This article was originally published\u00a0on the <a href=\"https:\/\/www.kentik.com\/blog\/latest-bgp-hijack-targets-hosting-software-vendor\/\">Kentik Blog<\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Summary<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">This post analyzes the technical details of the BGP hijack against Softaculous Ltd, the company behind the Softaculous auto-installer and the Virtualizor VM management platform. The hijack enabled an attacker to fraudulently obtain a TLS certificate and use it to deliver a malicious Virtualizor update to a portion of the company\u2019s customer base.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<p class=\"wp-block-paragraph\">Just days ago, a BGP hijack was used as part of an attack on hosting software vendor Softaculous Ltd, the company behind the Softaculous auto-installer and the Virtualizor VM management platform. In a&nbsp;<a href=\"https:\/\/www.virtualizor.com\/blog\/security-incident-bgp-hijacking\/\" target=\"_blank\" rel=\"noopener\">blog post on the incident<\/a>, the company explains that an attacker used a \u201ctechnically valid TLS certificate\u201d for their domains, in concert with a BGP hijack, to deliver a \u201cmalicious Virtualizor update package\u201d to a \u201csmall number of installations.\u201d They advise customers to follow a sequence of steps to check if they have been impacted.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">What follows is a closer look at some of the technical details of this incident.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How did the attacker hijack this IP space?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Beginning at 20:57 UTC on August 28, 2026, a new prefix entered the global routing table. 162.55.80.0\/24 was announced along the AS path:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u2026 6204 62390 24940<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">This address range included IP addresses used for Softaculous\u2019s software update endpoint as well as its client and billing site. It was a more-specific hijack of the 162.55.0.0\/16 normally originated by Hetzner Online (AS24940). The route likely originated with the penultimate AS in the path, NexonHost (AS62390), either through a compromise or a customer who took advantage of gaps in their security.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The hijack also included an AS path with a forged origin. Because the attacker appended 24940 as the rightmost ASN in the path, it was considered RPKI-valid for two reasons: the ROA required the origin to be AS24940 but&nbsp;<em>also<\/em>&nbsp;because it allowed the prefix length&nbsp;<a href=\"https:\/\/rpki-validator.ripe.net\/ui\/?validate-bgp=true&amp;prefix=162.55.0.0%2F16\" target=\"_blank\" rel=\"noopener\">to be anywhere between 24 and 16<\/a>. As a result, this route was RPKI-valid and would not be at risk of being dropped by ASes that reject RPKI-invalid routes.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Because there was no existing route for 162.55.80.0\/24 to compete against, it propagated as far as other route filtering mechanisms would allow. And because it was a more-specific route, any traffic destined for this IP range would prefer it over the legitimate route (162.55.0.0\/16) due to routers\u2019 preference for longest-prefix-match.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The timeline of the origination of 162.55.80.0\/24 is depicted in Kentik\u2019s BGP visualization below. The graphic depicts the percentage of BGP vantage points that had 162.55.80.0\/24 in their routing tables over time and can be interpreted as a measure of route propagation.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"604\" src=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/fig1-secuestro-bgp-1024x604.png\" alt=\"\" class=\"wp-image-34274\" srcset=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/fig1-secuestro-bgp-1024x604.png 1024w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/fig1-secuestro-bgp-300x177.png 300w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/fig1-secuestro-bgp-559x330.png 559w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/fig1-secuestro-bgp-768x453.png 768w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/fig1-secuestro-bgp.png 1281w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">The visualization helps to illustrate the timeline of the presence of 162.55.80.0\/24 in the global routing table. From the time it first emerged at 20:57 UTC on August 28, the route pulsed on and off several times until the real AS24940 began announcing it nearly 12 hours later, at 08:44 UTC on August 29. By 14:10 UTC the next day, AS24940 had withdrawn its route.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The hijack route returned at 19:55 UTC on August 29 and pulsed repeatedly until, once again, the real AS24940 intervened and began announcing 162.55.80.0\/24 at 05:45 UTC on August 30, at which time the hijack was withdrawn. At the time of this writing, AS24940 is still announcing 162.55.80.0\/24.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As the visualization above depicts, the propagation of the hijack route was slightly lower than that of the legitimate route, so there was some route filtering happening that limited further propagation. Regardless, the hijack propagation was substantial and created the potential for widespread misdirection of traffic to 162.55.80.0\/24.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How did the attacker get a valid TLS certificate?<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The BGP hijack alone wasn\u2019t enough to pull off this attack. Another critical piece to the puzzle is the issuance of valid TLS certificates to the attacker. The same flaw was exploited in the 2022 attack against KLAYswap, an online cryptocurrency exchange based in South Korea.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In their&nbsp;<a href=\"https:\/\/blog.citp.princeton.edu\/2022\/03\/09\/attackers-exploit-fundamental-flaw-in-the-webs-security-to-steal-2-million-in-cryptocurrency\/\" target=\"_blank\" rel=\"noopener\">excellent post on that incident<\/a>, Henry Birge-Lee and his colleagues at Princeton wrote,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Yet, ironically, KLAYswap and Kakao were properly using TLS, and it was not a vulnerability in the TLS protocol that was exploited during the attack. Instead, the attack exploited the false trust that TLS places in the routing infrastructure. \\ \u2026 \\ Using its BGP hijack, the adversary first targeted the PKI and launched a man-in-the-middle attack on the certificate distribution process. Only after it had acquired a valid digital certificate for the target domain did it aim its attack towards real users by serving its malicious JavaScript file over an encrypted connection.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"407\" src=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/fig2-secuestr-bgp-1024x407.png\" alt=\"\" class=\"wp-image-34277\" srcset=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/fig2-secuestr-bgp-1024x407.png 1024w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/fig2-secuestr-bgp-300x119.png 300w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/fig2-secuestr-bgp-680x271.png 680w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/fig2-secuestr-bgp-768x306.png 768w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/fig2-secuestr-bgp-1536x611.png 1536w, https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/fig2-secuestr-bgp.png 2006w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Original image credit: Henry Birge-Lee<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">TLS\u2019s identity guarantee is only as trustworthy as the routing system that gets certificate validation traffic to the right place. To address this weakness, public certificate authority Let\u2019s Encrypt has been doing&nbsp;<a href=\"https:\/\/letsencrypt.org\/2020\/02\/19\/multi-perspective-validation\" target=\"_blank\" rel=\"noopener\">Multi-Perspective Issuance Corroboration (MPIC)<\/a>&nbsp;for several years.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">In MPIC, instead of a CA validating domain control from a single vantage point (which a localized BGP hijack can spoof), the CA checks from multiple geographically and topologically diverse network locations simultaneously and requires a quorum to agree before issuing a certificate. A hijack that only reaches some vantage points gets caught by disagreement among the others.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, in this case, because the hijack route was an uncontested more-specific, its global propagation created a quorum entirely controlled by the attacker.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prevention and detection<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Also in 2022, a BGP hijack successfully targeted the cryptocurrency service Celer Bridge, hosted by AWS. In&nbsp;<a href=\"https:\/\/www.kentik.com\/blog\/bgp-hijacks-targeting-cryptocurrency-services\/\">the post I wrote at the time<\/a>, I cited AWS\u2019s then practice of using very liberal ROAs that allowed multiple origins and prefixes \u201cranging in size from a \/10 all the way down to a \/24\u201d as a factor that limited RPKI ROV\u2019s ability to help. In that post, I added,<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An alternative approach to ROA creation would be to do what other networks such as Cloudflare and Comcast have done: set the origin and maximum prefix length to be identical to how the prefix is routed. While this approach incurs an overhead cost of updating an ROA every time a route is modified, it also leaves little room for alternate versions of the route to come into circulation.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">AWS now does exact matches on its ROAs, but let\u2019s be careful not to oversell the capabilities of RPKI ROV to save us from a \u201cdetermined adversary\u201d such as this. We\u2019ve always known that attackers can forge AS paths to render hijacks RPKI-valid. But had Hetzner Online used strict ROAs with maximum prefix lengths that matched its routes, the circulation of the hijack would have been greatly diminished allowing MPIC to prevent the issuance of valid TLS certificates.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">As was the case with the Celer Bridge attack, BGP monitoring could have alerted that a new \/24 of Hetzner Online address space was being announced, although the forged origin may have caused it to appear legitimate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But when this new \/24 appeared with an unexpected upstream of NexonHost (AS62390), an alert should have drawn attention to this anomaly. The key detail here that would have distinguished this alert from the appearance of just another peer of Hetzner Online would have been that the new upstream was seen by the vast majority of BGP vantage points. In other words, this new prefix was getting exclusively transited by this relatively unknown hosting provider, and that could have caught the eye of the Hetzner Online NetOps team.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Conclusion<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">While RPKI ROV has meaningfully contributed to the reduction of routing mishaps, it is not designed to completely prevent an incident like this one. It works by reducing the propagation of leaked mis-originations, typically involving innocent mistakes. We\u2019ve also seen the benefits of RPKI ROV during so-called \u201cintentional, but also accidental\u201d hijacks, such as the&nbsp;<a href=\"https:\/\/www.kentik.com\/blog\/when-local-blocks-go-global-the-india-telegram-bgp-incident\/\">blocking of Telegram in India<\/a>&nbsp;back in June. Regardless, stricter ROAs could have allowed RPKI ROV to reduce the propagation of the hijacked route to the extent that MPIC could have prevented the issuance of a valid TLS certificate.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The infrastructure attacks like these highlight universal problems that aren\u2019t restricted to cryptocurrencies or hosting software. Companies looking to secure their internet-facing infrastructures need to deploy robust BGP and DNS monitoring of their infrastructure and any internet-based dependencies they may have.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Companies should reject RPKI-invalid routes while creating strict ROAs for their IP address space by including maximum prefix lengths that match the prefix lengths used in their routes. In fact,&nbsp;<a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc9319.html\" target=\"_blank\" rel=\"noopener\">RFC 9319 The Use of maxLength in the Resource Public Key Infrastructure<\/a>&nbsp;(RPKI) states that it is a \u201cbest current practice\u201d that networks entirely avoid using the maxLength attribute in ROAs, except in certain circumstances. Leaving the maxLength field blank in a ROA has the same effect as setting the maxLength field to match the prefix. These steps can significantly reduce the window of opportunity for an attacker to subvert your internet infrastructure.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>BY Doug MadoryDirector of Internet Analysis at KentiK This article was originally published\u00a0on the Kentik Blog Summary This post analyzes the technical details of the BGP hijack against Softaculous Ltd, the company behind the Softaculous auto-installer and the Virtualizor VM management platform. The hijack enabled an attacker to fraudulently obtain a TLS certificate and use [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":34280,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[919],"tags":[1280],"archivo":[1345,1451],"taxonomy-authors":[1418],"tipo_autor":[],"class_list":["post-34283","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-routing","tag-routing","archivo-editions","archivo-highlights-2023","taxonomy-authors-doug-madory-en"],"acf":{"author":"","related_notes":""},"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>LACNIC Blog | Latest BGP Hijack Targets Hosting Software Vendor<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"LACNIC Blog | Latest BGP Hijack Targets Hosting Software Vendor\" \/>\n<meta property=\"og:description\" content=\"BY Doug MadoryDirector of Internet Analysis at KentiK This article was originally published\u00a0on the Kentik Blog Summary This post analyzes the technical details of the BGP hijack against Softaculous Ltd, the company behind the Softaculous auto-installer and the Virtualizor VM management platform. The hijack enabled an attacker to fraudulently obtain a TLS certificate and use [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/\" \/>\n<meta property=\"og:site_name\" content=\"LACNIC Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/facebook.com\/lacnic\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-10T16:02:16+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-10T16:02:32+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/secuestro-bgp.png\" \/>\n\t<meta property=\"og:image:width\" content=\"680\" \/>\n\t<meta property=\"og:image:height\" content=\"330\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Gianni\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@lacnic\" \/>\n<meta name=\"twitter:site\" content=\"@lacnic\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/bgp-hijack\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/bgp-hijack\\\/\"},\"author\":{\"name\":\"Gianni\",\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/#\\\/schema\\\/person\\\/1338d9cfdb0137e8bc5581f3771f39ab\"},\"headline\":\"Latest BGP Hijack Targets Hosting Software Vendor\",\"datePublished\":\"2026-09-10T16:02:16+00:00\",\"dateModified\":\"2026-09-10T16:02:32+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/bgp-hijack\\\/\"},\"wordCount\":1460,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/bgp-hijack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/blog.lacnic.net\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/secuestro-bgp.png\",\"keywords\":[\"Routing\"],\"articleSection\":[\"Routing\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/bgp-hijack\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/bgp-hijack\\\/\",\"url\":\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/bgp-hijack\\\/\",\"name\":\"LACNIC Blog | Latest BGP Hijack Targets Hosting Software Vendor\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/bgp-hijack\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/bgp-hijack\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/blog.lacnic.net\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/secuestro-bgp.png\",\"datePublished\":\"2026-09-10T16:02:16+00:00\",\"dateModified\":\"2026-09-10T16:02:32+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/bgp-hijack\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/bgp-hijack\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/bgp-hijack\\\/#primaryimage\",\"url\":\"https:\\\/\\\/blog.lacnic.net\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/secuestro-bgp.png\",\"contentUrl\":\"https:\\\/\\\/blog.lacnic.net\\\/wp-content\\\/uploads\\\/2026\\\/09\\\/secuestro-bgp.png\",\"width\":680,\"height\":330,\"caption\":\"Secuestro de BGP utilizado para redirigir tr\u00e1fico hacia una infraestructura maliciosa.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/bgp-hijack\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Portada\",\"item\":\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Latest BGP Hijack Targets Hosting Software Vendor\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/#website\",\"url\":\"https:\\\/\\\/blog.lacnic.net\\\/\",\"name\":\"LACNIC Blog\",\"description\":\"En el Blog de LACNIC encontrar\u00e1s art\u00edculos t\u00e9cnicos vinculados al desarrollo de Internet en la regi\u00f3n de Am\u00e9rica Latina y el Caribe.\",\"publisher\":{\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/blog.lacnic.net\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/#organization\",\"name\":\"LACNIC Blog\",\"url\":\"https:\\\/\\\/blog.lacnic.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/blog.lacnic.net\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/lacnic-blog.svg\",\"contentUrl\":\"https:\\\/\\\/blog.lacnic.net\\\/wp-content\\\/uploads\\\/2023\\\/03\\\/lacnic-blog.svg\",\"caption\":\"LACNIC Blog\"},\"image\":{\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/facebook.com\\\/lacnic\",\"https:\\\/\\\/x.com\\\/lacnic\",\"https:\\\/\\\/www.instagram.com\\\/lacnic\\\/?hl=es-la\",\"https:\\\/\\\/uy.linkedin.com\\\/company\\\/lacnic\",\"https:\\\/\\\/www.youtube.com\\\/user\\\/lacnicstaff\",\"https:\\\/\\\/www.lacnic.net\\\/podcast\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/blog.lacnic.net\\\/#\\\/schema\\\/person\\\/1338d9cfdb0137e8bc5581f3771f39ab\",\"name\":\"Gianni\",\"url\":\"https:\\\/\\\/blog.lacnic.net\\\/en\\\/author\\\/gianni\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"LACNIC Blog | Latest BGP Hijack Targets Hosting Software Vendor","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/","og_locale":"en_US","og_type":"article","og_title":"LACNIC Blog | Latest BGP Hijack Targets Hosting Software Vendor","og_description":"BY Doug MadoryDirector of Internet Analysis at KentiK This article was originally published\u00a0on the Kentik Blog Summary This post analyzes the technical details of the BGP hijack against Softaculous Ltd, the company behind the Softaculous auto-installer and the Virtualizor VM management platform. The hijack enabled an attacker to fraudulently obtain a TLS certificate and use [&hellip;]","og_url":"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/","og_site_name":"LACNIC Blog","article_publisher":"https:\/\/facebook.com\/lacnic","article_published_time":"2026-09-10T16:02:16+00:00","article_modified_time":"2026-09-10T16:02:32+00:00","og_image":[{"width":680,"height":330,"url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/secuestro-bgp.png","type":"image\/png"}],"author":"Gianni","twitter_card":"summary_large_image","twitter_creator":"@lacnic","twitter_site":"@lacnic","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/#article","isPartOf":{"@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/"},"author":{"name":"Gianni","@id":"https:\/\/blog.lacnic.net\/#\/schema\/person\/1338d9cfdb0137e8bc5581f3771f39ab"},"headline":"Latest BGP Hijack Targets Hosting Software Vendor","datePublished":"2026-09-10T16:02:16+00:00","dateModified":"2026-09-10T16:02:32+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/"},"wordCount":1460,"commentCount":0,"publisher":{"@id":"https:\/\/blog.lacnic.net\/#organization"},"image":{"@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/secuestro-bgp.png","keywords":["Routing"],"articleSection":["Routing"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/blog.lacnic.net\/en\/bgp-hijack\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/","url":"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/","name":"LACNIC Blog | Latest BGP Hijack Targets Hosting Software Vendor","isPartOf":{"@id":"https:\/\/blog.lacnic.net\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/#primaryimage"},"image":{"@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/secuestro-bgp.png","datePublished":"2026-09-10T16:02:16+00:00","dateModified":"2026-09-10T16:02:32+00:00","breadcrumb":{"@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.lacnic.net\/en\/bgp-hijack\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/#primaryimage","url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/secuestro-bgp.png","contentUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/secuestro-bgp.png","width":680,"height":330,"caption":"Secuestro de BGP utilizado para redirigir tr\u00e1fico hacia una infraestructura maliciosa."},{"@type":"BreadcrumbList","@id":"https:\/\/blog.lacnic.net\/en\/bgp-hijack\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Portada","item":"https:\/\/blog.lacnic.net\/en\/"},{"@type":"ListItem","position":2,"name":"Latest BGP Hijack Targets Hosting Software Vendor"}]},{"@type":"WebSite","@id":"https:\/\/blog.lacnic.net\/#website","url":"https:\/\/blog.lacnic.net\/","name":"LACNIC Blog","description":"En el Blog de LACNIC encontrar\u00e1s art\u00edculos t\u00e9cnicos vinculados al desarrollo de Internet en la regi\u00f3n de Am\u00e9rica Latina y el Caribe.","publisher":{"@id":"https:\/\/blog.lacnic.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.lacnic.net\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/blog.lacnic.net\/#organization","name":"LACNIC Blog","url":"https:\/\/blog.lacnic.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.lacnic.net\/#\/schema\/logo\/image\/","url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/03\/lacnic-blog.svg","contentUrl":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2023\/03\/lacnic-blog.svg","caption":"LACNIC Blog"},"image":{"@id":"https:\/\/blog.lacnic.net\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/facebook.com\/lacnic","https:\/\/x.com\/lacnic","https:\/\/www.instagram.com\/lacnic\/?hl=es-la","https:\/\/uy.linkedin.com\/company\/lacnic","https:\/\/www.youtube.com\/user\/lacnicstaff","https:\/\/www.lacnic.net\/podcast"]},{"@type":"Person","@id":"https:\/\/blog.lacnic.net\/#\/schema\/person\/1338d9cfdb0137e8bc5581f3771f39ab","name":"Gianni","url":"https:\/\/blog.lacnic.net\/en\/author\/gianni\/"}]}},"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/blog.lacnic.net\/wp-content\/uploads\/2026\/09\/secuestro-bgp.png","wpml_current_locale":"en_US","wpml_translations":[{"locale":"es_ES","id":34270,"post_title":"El objetivo del \u00faltimo secuestro de BGP fue un proveedor de software de alojamiento","slug":"secuestro-bgp","href":"https:\/\/blog.lacnic.net\/secuestro-bgp\/"},{"locale":"pt_BR","id":34294,"post_title":"O mais recente sequestro do BGP teve como alvo um fornecedor de software de hospedagem.","slug":"sequestro-bgp","href":"https:\/\/blog.lacnic.net\/pt-br\/sequestro-bgp\/"}],"_links":{"self":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts\/34283","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/comments?post=34283"}],"version-history":[{"count":2,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts\/34283\/revisions"}],"predecessor-version":[{"id":34292,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/posts\/34283\/revisions\/34292"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/media\/34280"}],"wp:attachment":[{"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/media?parent=34283"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/categories?post=34283"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/tags?post=34283"},{"taxonomy":"archivo","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/archivo?post=34283"},{"taxonomy":"taxonomy-authors","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/taxonomy-authors?post=34283"},{"taxonomy":"tipo_autor","embeddable":true,"href":"https:\/\/blog.lacnic.net\/en\/wp-json\/wp\/v2\/tipo_autor?post=34283"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}