Loading story…
Sophos reported that some hosting environments are unintentionally (and in some cases deliberately) helping criminals conceal ransomware and malware infrastructure by repeatedly deploying preconfigured Windows VM images without changing default system identifiers such as hostnames. This results in large numbers of unrelated servers sharing the same computer name, which can make distinct threat operations appear connected and can cause older infrastructure to “disappear” and reappear under the same hostname but different IPs—complicating tracking, attribution, and takedown efforts. Sophos observed more than 7,000 servers associated with ransomware activity sharing a single hostname, and noted that this pattern can provide cover for short-lived ransomware operations among legitimate systems.
In investigations tied to recent WantToCry ransomware activity, Sophos found attackers abusing VMs provisioned via ISPsystem’s VMmanager (a legitimate virtualization management platform used by hosting providers) to host and deliver payloads at scale, with identical hostnames indicating reuse of default Windows templates. The same hostname patterns were also observed across infrastructure linked to multiple operations, including LockBit, Qilin, Conti, ALPHV/BlackCat, and malware campaigns involving Ursnif, RedLine, and Lummar. Sophos assessed that bulletproof hosting providers can exploit this design/operational weakness to blend malicious C2 and payload-delivery systems into large pools of innocuous VMs; cited providers associated with this activity included Stark Industries Solutions Ltd., Zomro B.V., First Server Limited, Partner Hosting LTD, and JSC IOT.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
After reporting on Sophos' findings, BleepingComputer contacted ISPsystem for comment regarding the abuse of its VMmanager platform and possible mitigations. No statement was available at the time of publication.
Sophos assessed that a small cluster of disreputable or sanctioned hosting providers were predominant hosts for the malicious VMs, naming providers such as MasterRDP, Stark Industries Solutions Ltd., and Zomro B.V. The report said these providers used VMmanager-based infrastructure to support ransomware and malware operations while resisting legal or takedown requests.
Sophos disclosed that bulletproof hosting providers were repeatedly deploying preconfigured Windows VM images without changing default settings, causing thousands of servers to share the same hostnames. The company said this made unrelated criminal operations appear linked, complicated attribution, and slowed takedown efforts.
During investigations into recent WantToCry and other ransomware incidents, Sophos identified many attacker-controlled Windows VMs sharing identical hostnames and system identifiers consistent with VMmanager default Windows templates. The pattern allowed researchers to map thousands of active devices and connect infrastructure used by ransomware and infostealer operations.
In late 2025, multiple ransomware incidents revealed attackers renting virtual machines provisioned through ISPsystem's VMmanager platform to host command-and-control and payload-delivery infrastructure. The use of legitimate data-center VMs gave threat actors high-bandwidth, trusted-looking systems that helped them evade blocks and suspicion.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcescworld.com
Open sourcescworld.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos researchers investigating late-2025 **WantToCry** ransomware incidents found repeated use of Windows virtual machines provisioned through **ISPsystem VMmanager**, where default images assigned static, autogenerated hostnames that were not randomized during deployment. Those identifiers appeared across thousands of internet-exposed **RDP** systems, heavily concentrated in Russia and nearby regions, and surfaced in operations tied to multiple malware and ransomware families including **LockBit**, **Qilin**, **BlackCat/ALPHV**, **Conti**, **TrickBot**, **Ursnif**, and **NetSupport RAT**. The report says the pattern does not prove a single shared operator, because unrelated actors can inherit the same hostnames and artifacts simply by using the same VM template. Sophos also found many of the exposed systems clustered at hosting providers including **Stark Industries Solutions Ltd** and **First Server Limited**, both previously linked in public reporting and sanctions to Russian state-connected or criminal activity, alongside underground advertising for bulletproof hosting and leased RDP access. Researchers concluded that **ISPsystem VMmanager** is legitimate software, but its low-cost, turnkey deployment model and common default configurations have made it attractive infrastructure for ransomware, malware delivery, phishing, botnet management, and data staging.
Jun 29, 2026
Threat actors are increasingly abusing **QEMU** to launch hidden virtual machines on compromised Windows hosts, allowing credential theft, reconnaissance, command-and-control, data staging, and ransomware preparation to occur outside the visibility of many endpoint security tools. Sophos linked one campaign, **STAC4713**, to **GOLD ENCOUNTER** and the **PayoutsKing** ransomware operation, where attackers gained access through exposed SonicWall VPNs without MFA and exploitation of **SolarWinds Web Help Desk** `CVE-2025-26399`, then created a SYSTEM-level scheduled task such as **TPMProfiler** to start `qemu-system-x86_64.exe`, boot a disguised Alpine Linux virtual disk, and establish reverse SSH tunnels for covert access. Researchers said the hidden VM hosted tooling including **AdaptixC2**, **Chisel**, **Rclone**, and **wg-obfuscator**, enabling stealthy persistence and exfiltration while leaving limited forensic evidence on the host. A second campaign, **STAC3725**, exploited **CitrixBleed2** `CVE-2025-5777`, installed a malicious **ScreenConnect** client, created a rogue local administrator account, and used a QEMU-based VM to assemble offensive tooling such as **Impacket**, **BloodHound.py**, **Kerbrute**, **KrbRelayX**, **NetExec**, and **Metasploit** for post-compromise operations. Reporting also noted broader initial-access methods, including phishing and fake Microsoft Teams IT-support lures, and warned that adversaries may shift between QEMU and other virtualization or sideloading techniques while keeping the same objective of stealthy intrusion and ransomware enablement. Defenders were urged to hunt for unauthorized QEMU installations, suspicious SYSTEM scheduled tasks, unusual SSH tunneling or port forwarding, disguised virtual disk images, and related indicators including the domain **vtps.us**, while prioritizing MFA and patching for `CVE-2025-26399` and `CVE-2025-5777`.
Jun 29, 2026
Reporting describes several unrelated but contemporaneous malware operations targeting both Windows and Linux environments. In Taiwan, FortiGuard Labs observed targeted phishing using tax and e-invoice lures to deliver **Winos 4.0 (ValleyRat)** and plugins, with delivery chains including malicious `.LNK` files, **DLL sideloading**, and **BYOVD** using the vulnerable driver `wsftprm.sys`, supported by rapidly rotating domains and cloud-hosted infrastructure that reduces the effectiveness of static blocklists. Separately, Cato CTRL reported a new Windows loader, **Foxveil**, that stages and retrieves shellcode via trusted platforms (**Cloudflare Pages**, **Netlify**, and **Discord attachments**) and executes payloads using techniques including **Early Bird APC injection** (often into a fake `svchost.exe`) or self-injection, while persisting via Windows services or masqueraded binaries dropped into `SysWOW64`. Additional reporting covers distinct campaigns in other regions and platforms. A LATAM-focused intrusion chain uses fake bank receipt lures (double-extension such as `.pdf.js`) to deliver **XWorm v5.6**, employing oversized/obfuscated JavaScript, WMI-based process creation (`Win32_Process`) to launch hidden PowerShell, and abuse of a hardcoded **Cloudinary** URL for staging—capabilities consistent with credential theft and enabling follow-on ransomware. Trellix analysis described a separate **Monero** cryptomining operation distributed via pirated software installers that propagates through **USB/external drives** to reach even air-gapped systems, using multi-component “watchdog” self-healing behavior and aggressive defense-evasion. On Linux, LevelBlue detailed a new **SysUpdate** variant (packed `ELF64`) that performs host reconnaissance and uses strong C2 encryption; researchers built a **Unicorn Engine**-based emulation tool to reproduce key generation/encryption routines and decrypt captured C2 traffic for investigation and detection engineering.
Jun 29, 2026