Loading story…
Sophos researchers investigating late-2025 WantToCry ransomware incidents found repeated use of Windows virtual machines provisioned through ISPsystem VMmanager, where default images assigned static, autogenerated hostnames that were not randomized during deployment. Those identifiers appeared across thousands of internet-exposed RDP systems, heavily concentrated in Russia and nearby regions, and surfaced in operations tied to multiple malware and ransomware families including LockBit, Qilin, BlackCat/ALPHV, Conti, TrickBot, Ursnif, and NetSupport RAT.
The report says the pattern does not prove a single shared operator, because unrelated actors can inherit the same hostnames and artifacts simply by using the same VM template. Sophos also found many of the exposed systems clustered at hosting providers including Stark Industries Solutions Ltd and First Server Limited, both previously linked in public reporting and sanctions to Russian state-connected or criminal activity, alongside underground advertising for bulletproof hosting and leased RDP access. Researchers concluded that ISPsystem VMmanager is legitimate software, but its low-cost, turnkey deployment model and common default configurations have made it attractive infrastructure for ransomware, malware delivery, phishing, botnet management, and data staging.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Sophos publicly released its report concluding that ISPsystem VMmanager is legitimate software but that its low-cost, turnkey deployment model and widespread use make it attractive to threat actors while also blending in with legitimate deployments.
The researchers found concentrations of these systems at providers including Stark Industries Solutions Ltd and First Server Limited and identified underground advertising for bulletproof hosting and RDP services tied to the same ISPsystem-derived infrastructure.
Sophos confirmed that ISPsystem VMmanager default Windows images contain fixed hostnames and related identifiers that are not randomized during provisioning, which can make unrelated threat actors appear to share infrastructure.
During the investigation, Sophos found that these template-derived hostnames appeared on thousands of internet-exposed RDP systems, especially in Russia and nearby regions, and were seen across operations involving LockBit, Qilin, BlackCat/ALPHV, Conti, TrickBot, Ursnif, NetSupport RAT, and other malware campaigns.
In late 2025, Sophos Counter Threat Unit investigated WantToCry ransomware cases and observed repeated use of Windows virtual machines with static autogenerated hostnames derived from ISPsystem VMmanager templates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that some hosting environments are unintentionally (and in some cases deliberately) helping criminals **conceal ransomware and malware infrastructure** by repeatedly deploying **preconfigured Windows VM images** without changing default system identifiers such as hostnames. This results in large numbers of unrelated servers sharing the same computer name, which can make distinct threat operations appear connected and can cause older infrastructure to “disappear” and reappear under the same hostname but different IPs—complicating tracking, attribution, and takedown efforts. Sophos observed more than **7,000 servers** associated with ransomware activity sharing a single hostname, and noted that this pattern can provide cover for short-lived ransomware operations among legitimate systems. In investigations tied to recent **WantToCry** ransomware activity, Sophos found attackers abusing VMs provisioned via *ISPsystem*’s **VMmanager** (a legitimate virtualization management platform used by hosting providers) to host and deliver payloads at scale, with identical hostnames indicating reuse of default Windows templates. The same hostname patterns were also observed across infrastructure linked to multiple operations, including **LockBit**, **Qilin**, **Conti**, **ALPHV/BlackCat**, and malware campaigns involving **Ursnif**, **RedLine**, and **Lummar**. Sophos assessed that **bulletproof hosting providers** can exploit this design/operational weakness to blend malicious C2 and payload-delivery systems into large pools of innocuous VMs; cited providers associated with this activity included **Stark Industries Solutions Ltd.**, **Zomro B.V.**, **First Server Limited**, **Partner Hosting LTD**, and **JSC IOT**.
Jun 29, 2026
Sophos reported that the **WantToCry** ransomware is targeting internet-exposed SMB services on ports `139` and `445`, using weak, brute-forced, or stolen credentials to access shared files without deploying malware on the victim host. Instead of encrypting data locally, the attackers copy files over authenticated SMB sessions to attacker-controlled servers, encrypt them remotely, and write the encrypted versions back to the original shares, appending the `.want_to_cry` extension and dropping ransom notes such as `!want_to_cry.txt` or `!Want_To_Cry.txt`. The notes direct victims to qTox or Telegram and typically demand about **$600 in Bitcoin**. Researchers said the technique reduces traditional endpoint detection opportunities because it leaves few host-based artifacts and relies on seemingly normal SMB file operations, though network and authentication traces remain visible. Sophos linked the activity to infrastructure in **Russia, Germany, the United States, and Singapore**, including systems previously associated with **NetSupport RAT** and **LockBit, Qilin, and ALPHV/BlackCat** activity, while noting the ransomware is unrelated to the 2017 **WannaCry** worm despite the similar name. The company said the attacks appear focused on hosts exposing SMB rather than broad enterprise-wide deployment and urged organizations to block inbound SMB, disable **SMBv1** and anonymous access, monitor unusual external SMB activity, and protect backups from SMB-based access.
Jun 29, 2026
VMRay Labs detailed **Operation STANDOFF**, a previously unattributed Russian-speaking cybercriminal campaign that delivers multiple payloads through a pay-per-install `NSIS` loader masquerading as `setup_x86_x64_install.exe`. The operation has been observed deploying **Raccoon Stealer, RedLine Stealer, Amadey, SmokeLoader, Socelars, Glupteba, XMRig**, and **WebBrowserPassView**, combining credential theft, botnet activity, and cryptomining in a single infection chain. Researchers said the operators used layered evasion and persistence techniques, including disabling Microsoft Defender, anti-VM and anti-debug checks, scheduled tasks, registry `Run` keys, fake VirtualBox-named services, and a masqueraded `csrss.exe` path, while a gaming-themed **“Mobile Arena”** lure targeted young Russian-speaking users. The campaign’s infrastructure included command-and-control systems hosted on **TimeWeb Ltd.**, a broader 44-server cluster, and dead-drop resolvers on **Telegram, Mastodon, and Pastebin**. Additional reporting tied the operation to command-and-control traffic concealed behind **GitHub redirects** and exposed indicators including suspicious installer filenames, hashes, domains, IP addresses, Telegram and social-media handles, anti-virtualization artifacts, and **Monero** mining infrastructure such as `pool.supportxmr.com:3333`. VMRay also identified **STANDOFF COORD**, a Russian-language multi-operator console designed for **Active Directory** intrusion, alongside a separate AI-enabled influence platform used for Telegram account farming and mass messaging.
Jul 28, 2026