Attackers hijacked an Internet route, obtained a valid Let’s Encrypt certificate and fed a malicious update to Virtualizor hypervisors. The breach reveals how routing, TLS and unsigned software can combine to make an impostor look completely legitimate.