Executive Summary
In late August 2026, Virtualizor, a widely used VPS control panel, suffered a supply chain compromise. Attackers modified legitimate PHP files and startup scripts distributed via the platform's update mechanism to achieve root-level access on affected hypervisors. The infection involves the deployment of a Java-based Remote Access Trojan (RAT) called 'nerat', which establishes persistence and enables interactive attacker sessions.
Technical analysis shows the attack chain begins with injected `@exec()` commands in Virtualizor's core PHP files, which trigger the download of a malicious JAR file ('widdow.jar'). Once executed as root, the malware installs a persistent systemd service, adds an unauthorized SSH key to the root account, and creates a secondary backdoor user named 'proxyuser'. This gives attackers full control over the host hypervisor and potential access to all hosted virtual private servers (VPS).
This incident is critical for hosting providers using Virtualizor. Because root-level access was obtained, affected systems should be considered fully compromised. Simply deleting malicious files is insufficient; a full rebuild from scratch is recommended to ensure system integrity and prevent latent persistence.