BGP Hijacking Incident Highlights Critical Internet Routing Security Gaps

Similar to Hetzner Online, Softaculous and Hetzner Online’s downstream transit provider, Zet.net, failed to adequately monitor their networks. As a result, the routing hijack went undetected for up to 22 hours, occurring intermittently during that period. Questions also remain about another hosting provider, Nexon Host, whose infrastructure appears to have enabled the malicious route announcements.

Ben Cartwright-Cox, a BGP security expert and creator of the BGP tool suite, described the incident as a “stupid and avoidable mistake.” Softaculous, Hetzner Online, and Zet.net did not immediately respond to emailed requests for comment.

A Brief History of BGP

Border Gateway Protocol, or BGP, is the foundation that connects the Internet’s many independent networks into a single global system. The Internet is divided into thousands of autonomous systems, commonly identified by autonomous system numbers (ASNs). Each autonomous system manages its own network and a specific range of IP addresses, including addresses assigned under the IPv4 protocol.

BGP allows these autonomous systems to exchange information about how Internet traffic should be routed. For example, when a network in Germany needs to reach an IP address in North America, BGP routing announcements identify the autonomous systems through which the traffic should travel. These announcements become entries in the global routing table used by networks, Internet service providers, and hosting companies worldwide.

When BGP was first developed, it relied largely on trust. Network operators generally assumed that routing announcements were accurate and made in good faith. However, BGP does not inherently verify whether the network making an announcement is authorized to advertise a particular IP address range.

Attackers have repeatedly exploited this weakness by announcing routes for IP addresses they do not legitimately control. Both nation-state actors and financially motivated cybercriminal groups have used BGP hijacking to redirect Internet traffic, intercept sensitive communications, disrupt online services, and, in some cases, transfer petabytes of data through networks under their control.

To improve Internet routing security, network engineers developed protections designed to verify the legitimacy of BGP announcements. Two of the most important technologies are Resource Public Key Infrastructure (RPKI) and Route Origin Validation (ROV).

RPKI uses a cryptographic record called a Route Origin Authorization (ROA). A ROA identifies the autonomous system authorized to originate a specific IP address prefix and defines the maximum prefix length it may advertise. Networks that deploy RPKI-based ROV can compare incoming BGP announcements with these records and reject routes that do not match.

Although RPKI and ROV can significantly reduce the spread of BGP hijacking attacks, they are effective only when network operators properly configure, monitor, and enforce them. The latest incident demonstrates how inadequate monitoring and routing-security controls can allow malicious announcements to remain active for hours.