WantToCry and Other Threat Actors Abused ISPsystem VMmanager-Based RDP Infrastructure
Threat Actor Intelligence · 2 sources · Updated 4mo ago · First seen May 25, 2026
Sophos researchers investigating late-2025 WantToCry ransomware incidents found repeated use of Windows virtual machines provisioned through ISPsystem VMmanager, where default images assigned static, autogenerated hostnames that were not randomized during deployment. Those identifiers appeared across thousands of internet-exposed RDP systems, heavily concentrated in Russia and nearby regions, and surfaced in operations tied to multiple malware and ransomware families including LockBit, Qilin, BlackCat/ALPHV, Conti, TrickBot, Ursnif, and NetSupport RAT.
The report says the pattern does not prove a single shared operator, because unrelated actors can inherit the same hostnames and artifacts simply by using the same VM template. Sophos also found many of the exposed systems clustered at hosting providers including Stark Industries Solutions Ltd and First Server Limited, both previously linked in public reporting and sanctions to Russian state-connected or criminal activity, alongside underground advertising for bulletproof hosting and leased RDP access. Researchers concluded that ISPsystem VMmanager is legitimate software, but its low-cost, turnkey deployment model and common default configurations have made it attractive infrastructure for ransomware, malware delivery, phishing, botnet management, and data staging.
