Loading story…
Microsoft Threat Intelligence reported that RedVDS, a virtual dedicated server marketplace offering low-cost, Windows-based RDP virtual machines with full admin control, was widely used by financially motivated actors to scale BEC, mass phishing, account takeover, and other fraud across multiple sectors and countries. Microsoft attributed operation of the service to Storm-2470 and observed other tracked actors leveraging the infrastructure, noting that RedVDS’s reuse of a cloned Windows host image created technical fingerprints defenders could use for detection.
Microsoft’s Digital Crimes Unit (DCU) said it worked with international partners to seize RedVDS infrastructure and take the service offline, alongside civil actions in the U.S. and U.K. to further disrupt operations. Microsoft assessed RedVDS activity contributed to at least $40M in U.S. fraud losses since March 2025 and cited impacts including the compromise or fraudulent access of 191,000+ Microsoft email accounts across 130,000+ organizations since September 2025; named victims joining as co-plaintiffs included H2 Pharma (losses of $7.3M+) and Gatehouse Dock Condominium Association (nearly $500K).
TTPs, infrastructure, and targeting history in one profile.
9 events from the most recent confirmed update back to the earliest known activity.
On January 14, 2026, Microsoft disclosed the takedown of RedVDS and said the service had enabled phishing, account takeover, business email compromise, and large-scale fraud worldwide.
Working with Europol and German authorities, Microsoft helped seize two domains, take down the RedVDS marketplace and customer portal, and confiscate key infrastructure powering the service.
Microsoft pursued coordinated civil legal action in both the United States and the United Kingdom against RedVDS infrastructure and operators, marking a key step in the disruption effort.
Researchers reported RedVDS instances were repeatedly provisioned from a single cloned Windows Server 2022 image, often exposing the same computer name and related identifiers that defenders could use for detection.
Microsoft Threat Intelligence identified the operator and maintainer of RedVDS as the threat actor it tracks as Storm-2470, while also linking several other cybercrime groups to use of the service.
In one month, Microsoft saw actors controlling more than 2,600 RedVDS VMs send about 1 million phishing messages per day to Microsoft customers, illustrating the platform's scale.
Since September 2025, Microsoft observed RedVDS-enabled activity leading to compromise or fraudulent access of more than 191,000 Microsoft email accounts across over 130,000 organizations worldwide.
Microsoft said RedVDS-enabled activity was tied to roughly $40 million in reported U.S. fraud losses beginning in March 2025, reflecting its growing role in financially motivated cybercrime.
RedVDS was publicly operating by 2019, offering low-cost disposable Windows-based virtual servers that criminals could rent for phishing, fraud, and business email compromise activity.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
13 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcerescana.com
Open sourcecybersecuritynews.com
Open sourcego.theregister.com
Open sourcemicrosoft.com
Open sourceblogs.microsoft.com
Open sourcecyberscoop.com
Open sourcedarkreading.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Justice Department and Microsoft disrupted infrastructure used by **Star Blizzard**, a Russia-linked threat group tied to the FSB, by seizing more than 100 internet domains used in spear-phishing and credential-theft operations. Federal investigators obtained a warrant for **41 domains**, while Microsoft secured a civil court order covering **66 more**, targeting infrastructure allegedly operated by the group also known as **Callisto Group**, **COLDRIVER**, and **SEABORGIUM**. Authorities said the domains were used to impersonate trusted contacts and lure victims into surrendering credentials or granting access to email accounts and computers. U.S. officials said the campaign targeted government personnel, former intelligence officials, Department of Defense and State employees, defense contractors, Department of Energy staff, journalists, think tanks, NGOs, and other civil society organizations. The Justice Department said the operation sought sensitive information related to U.S. defense, foreign affairs, and nuclear energy research, while Microsoft reported that Star Blizzard had targeted at least **82 customers** and more than **30 civil society organizations** since 2023, at a pace of roughly one attack per week. The disruption was presented as part of a broader effort to blunt Russian intelligence collection and reduce the risk of interference affecting democratic institutions and public-interest groups.
Jun 29, 2026
Microsoft, Europol, law enforcement agencies, and multiple private-sector partners carried out a coordinated disruption of the **StealC** infostealer and **Amadey** loader ecosystems, using court orders and related legal actions to target both malware operations at once. The operation struck a broad criminal infrastructure spanning more than 200 command-and-control domains and IP addresses, with partner reporting citing **66 domains** and **296 servers** tied to the two services. Microsoft said the malware families were linked to more than **140,000 infected computers** in a single week in May, while partner investigators reported the seizure of **25.6 million unique credentials** stolen from more than **385,000 compromised systems**. Investigators said **StealC**, active since 2023 as a malware-as-a-service infostealer, was used to steal browser data, credentials, email and messaging data, VPN and cloud access, and cryptocurrency wallet information, while **Amadey**, active since 2018, functioned as a modular loader and backdoor that frequently delivered StealC and other payloads. Researchers also identified a vulnerability in the StealC command-and-control panel that helped support search-and-seizure actions, and they used configuration extraction and a custom emulator to map affiliate activity and delivery chains. The two malware families were described as part of a broader cybercrime ecosystem tied to credential theft, access brokering, and downstream attacks including ransomware, with observed links to payloads such as **AsyncRAT**, **RedLine**, **Vidar**, **XMRig**, and in one case **LockBit Black**.
Aug 11, 2026
Microsoft, Health-ISAC, law enforcement, and private-sector partners disrupted **EvilTokens**, an AI-enabled phishing-as-a-service platform attributed to threat actor **Storm-2992**. A federal court order enabled the seizure of 50 EvilTokens websites and the disabling of more than 175 supporting domains; UK Metropolitan Police also arrested two suspected operators in the greater London area. The service was linked to more than 12,000 compromised Microsoft customer inboxes across over 10,000 organizations worldwide, while known FBI IC3 complaints associated it with approximately $1.7 million in losses. EvilTokens conducted OAuth 2.0 device-code phishing against Microsoft Entra ID, directing victims to Microsoft’s legitimate device-login page and capturing access and refresh tokens after authentication, thereby bypassing the practical protections of MFA. The platform used Microsoft Graph API access and an AI-style chatbot to examine stolen mailboxes for trusted contacts, payment information, high-value users, and global administrators, supporting business-email-compromise and financial-fraud operations. SpyCloud contributed recaptured data involving more than 8,700 victims, reporting that 97.5% of affected accounts were on enterprise domains; Coinbase traced roughly $1.1 million in revenue paid by the platform’s customers to its operators.
Sep 24, 2026