VestaCP installer leaked admin passwords

VestaCP's installer carried malicious code in 2018. The change appeared in commit a3f0fa1 on May 31 and was removed in commit ee03eff on June 13. During that window, new installations exposed the base64-encoded admin password and server domain through the normal install path.

The leak was quiet because it used Vesta's own infrastructure. ESET traced the relevant line to vst-install-ubuntu.sh, where $codename contained the password and host name sent to http://vestacp.com/notify/. A VestaCP team member later said their infrastructure server had been hacked, likely through an API bug in release 0.9.8-20, and that attackers changed installation scripts to log admin passwords and IP addresses.

The impact surfaced months later. Forum users reported VestaCP servers being used for abnormal bandwidth and outbound attacks. One September report showed an attacker using the admin password over SSH to run creator-x86_64-1 from /var/tmp and erase auth logs. Vesta told users to change admin passwords and check for /usr/bin/dhcprenew.

ESET analyzed the malware as Linux/ChachaDDoS. It persisted as dhcprenew, hid as [kworker/1:1], downloaded architecture-specific second stages, decrypted them with ChaCha, and ran Lua tasks. Observed tasks performed SYN DDoS attacks. The supply-chain failure was the credential leak; the botnet was the consequence.