Poisoned Pipeline / Techniques / T0212

T0212 · Initial Access · TA03 · observed in 1 incident(s)

Subvert network routing to intercept update traffic

The attacker manipulates network routing — BGP route hijacking, DNS
hijacking, or ARP spoofing — so that traffic to a legitimate hostname
(a vendor update server, billing backend, package registry, or mirror)
is delivered to attacker-controlled servers instead. Consumers keep
talking to the correct hostname; only the path through the network
changes. Because the malicious server is not the vendor's, the vendor
has no server-side logs of who was served, and hostname/origin-based
allowlists and TLS to a correctly-named host do not by themselves stop
the interception. Distinct from T0209 (compromising the registry or
CDN origin itself) and T0205 (compromising a third-party CDN or hosted
web asset): here the routing layer is subverted while the destination
infrastructure stays untouched.

Where this idea came from

Public incident / advisory

This catalogue, from the Virtualizor/Softaculous BGP route hijack (BleepingComputer write-up; Softaculous confirmed and now signs all packages).

• https://www.bleepingcomputer.com/news/security/hackers-push-malicious-virtualizor-update-in-bgp-hijacking-attack/
• https://www.softaculous.com/blog/security-incident-bgp-hijacking-update/

Mitigations

None linked yet.

Detections

None linked yet.

Observed in incidents (1)

• Virtualizor panel update delivered via BGP hijack of Softaculous update/billing infrastructure

References

None listed.