Ransomware Infrastructure Obfuscated by Reused Default Windows VM Templates

Sophos reported that some hosting environments are unintentionally (and in some cases deliberately) helping criminals conceal ransomware and malware infrastructure by repeatedly deploying preconfigured Windows VM images without changing default system identifiers such as hostnames. This results in large numbers of unrelated servers sharing the same computer name, which can make distinct threat operations appear connected and can cause older infrastructure to “disappear” and reappear under the same hostname but different IPs—complicating tracking, attribution, and takedown efforts. Sophos observed more than 7,000 servers associated with ransomware activity sharing a single hostname, and noted that this pattern can provide cover for short-lived ransomware operations among legitimate systems.

In investigations tied to recent WantToCry ransomware activity, Sophos found attackers abusing VMs provisioned via ISPsystem’s VMmanager (a legitimate virtualization management platform used by hosting providers) to host and deliver payloads at scale, with identical hostnames indicating reuse of default Windows templates. The same hostname patterns were also observed across infrastructure linked to multiple operations, including LockBit, Qilin, Conti, ALPHV/BlackCat, and malware campaigns involving Ursnif, RedLine, and Lummar. Sophos assessed that bulletproof hosting providers can exploit this design/operational weakness to blend malicious C2 and payload-delivery systems into large pools of innocuous VMs; cited providers associated with this activity included Stark Industries Solutions Ltd., Zomro B.V., First Server Limited, Partner Hosting LTD, and JSC IOT.