BGP Hijack Delivers Malicious Virtualizor Update That Establishes Persistent Root Access

Attackers exploited BGP routing vulnerabilities to intercept and replace legitimate Virtualizor software updates with a malicious package, effectively weaponizing the software supply chain against downstream hypervisor infrastructure. Because the update appeared to originate from a trusted source, security controls designed to block external threats were bypassed entirely. The resulting persistent root access — achieved through modified system files and a rogue systemd service — gave attackers deep, durable control over compromised hypervisors. This incident highlights the critical danger of trusting update integrity solely based on network origin rather than cryptographic verification. The potential exposure of client sessions and payment data compounds the severity and underscores why supply chain attacks targeting infrastructure management tools carry outsized risk.