The evolution of cybercrime has led to infrastructure becoming less of a matter of ownership and more of a convenience issue. As opposed to investing time and resources in the construction and maintenance of dedicated command-and-control servers, ransomware operators are increasingly renting inexpensive virtual machines that blend seamlessly into legitimate hosting environments as a practical alternative.
As a result of this shift, attackers have enhanced their operational strategy by embedding their activities within widely used infrastructure, thereby gaining scalability, plausible deniability, and operational resilience.
In the event of the disruption of one node, dozens, sometimes hundreds, of nearly identical systems continue to run in parallel, ensuring that campaigns continue uninterrupted.
Sophos investigators, following this operational shift, identified a series of recent WantToCry ransomware attacks that were triggered by virtual machines that were provisioned through infrastructure managed by ISPsystem, a legitimate provider of virtualization and hosting control panels.
In forensic analysis of several incidents, researchers observed an underlying pattern: attackers controlled Windows virtual machines whose hostnames were the same.
As the systems appeared to have been deployed using default Windows templates from ISPsystem's VMmanager platform, it can be deduced that threat actors were utilizing standardized rather than customized builds.
Based on the correlation between telemetry and sinkhole data, it was found that the same hostname conventions were shared among infrastructures associated with multiple ransomware operations, including LockBit, Qilin, Conti, BlackCat, also known as ALPHV, and Ursnif, a banking trojan. In addition to ransomware, infrastructure overlaps with campaigns distributing information-stealing malware, such as RedLine and Lumma.
A high frequency of identical system identifiers between geographically dispersed incidents indicates the reuse of templates rather than isolated deployments within the virtual environment. ISPsystem's VMmanager platform facilitates rapid provisioning and lifecycle management of Windows and Linux virtual machines, making it widely used by hosting providers.
According to Sophos, the default Windows images in VMmanager use the same hostname and certain system identifiers upon deployment. Within benign environments, such uniformity may go unnoticed, while within hostile environments, it becomes a disguise.
The bulletproof hosting operators exploit this architectural feature by enabling their clients to instantiate virtual machines en masse, which allow malicious command-and-control and payload delivery servers to be embedded within pools of otherwise legitimate systems. The result is infrastructure dilution: malicious nodes become statistically indistinguishable from thousands of benign peers, resulting in a challenge in attribution efforts and a reduced likelihood of swift remediation.
Several of these virtual machines had a concentration that was not evenly distributed. A significant proportion were traced to a small number of hosting providers with history of abuse complaints or regulatory scrutiny, such as Stark Industries Solutions Ltd., Zomro B.V., First Server Limited, Partner Hosting LTD, and JSC IOT.
Moreover, researchers identified MasterRDP as a recurrent element in the ecosystem, providing VPS and RDP services that are resistant to legal intervention while maintaining direct control over physical infrastructure. The Sophos analysis revealed that over 95 percent of ISPsystem virtual machines with internet-facing hostnames came from four default Windows hostnames generated by ISPsystems.
There was a correlation between each of these identifiers and detected cybercriminal activity, strengthening the assertion that templated infrastructure is being systematically repurposed to sustain large-scale ransomware and malware operations.
After expanding their dataset, the researchers identified over 7,000 internet-facing servers sharing one autogenerated hostname, which were spread across Russian, multiple European countries, the United States, as well as Iran and Israel. According to Sophos' Counter Threat Unit, two hostnames in particular recurred consistently both in the WantToCry investigation and in the reporting of general threat intelligence.
The identifiers identified in this report were not restricted to one particular campaign. Observations from third parties and telemetry correlated them with operations involving LockBit, Qilin, and BlackCat, as well as NetSupport RAT deployments.
Among the uses of these systems have been host-and-control servers for ransomware, secondary malware payloads distribution, phishing campaigns, botnet management, and staging exfiltrated data for monetization.
This pattern of reusable infrastructure templates is likely to have persisted for a minimum of five years, according to investigators.
Ironically, despite the strategy reducing operational costs and speeding up deployment for threat actors, it introduces a measurable signature. Defenders can benefit from the widespread reuse of static hostnames across thousands of ISPsystem-provided virtual machines by clustering these hosts into clusters that can be useful for attribution and campaign tracking.
Virtual machines were identified by a narrow group of hosting providers, including several companies which have been repeatedly linked to cybercriminal or state-sponsored activity. According to Sophos, some legitimate traffic may originate from these environments, however additional intelligence identifies Stark Industries Solutions Ltd. as the most prominent provider.
Cybercriminal ecosystems and Russian state-sponsored operations are linked to First Server Limited and First Server Limited.
Regulatory scrutiny has followed the establishment of Stark Industries in early 2022, shortly prior to the Russian invasion of Ukraine. Several threat groups have been observed to leverage Stark Industries' infrastructure since that time.
Stark Industries Solutions and its operators were imposed restrictive measures by the European Council in May of last year for their involvement in destabilizing activities by Russian state-affiliated actors, based on their role in facilitating such activities.
Due to its apparent connection with Doppelganger, a Russian disinformation campaign sanctioned by the UK government in October 2024, First Server Limited has also received attention.
According to our assessment, MasterRDP is among a number of bulletproof hosting providers that lease ISPsystem managed virtual machines on abuse-tolerant infrastructure to customers who conduct ransomware and malware operations.
ISPsystem's VMmanager remains a viable and widely used virtualization management platform in the global hosting industry, according to researchers.
The software itself is not inherently malicious; however, it is attractive to threat actors seeking scalable infrastructure due to its low cost, ease of onboarding, and rapid deployment capabilities.
A combination of its widespread user base with its extensive ubiquity allows malicious deployments to maintain operational cover, enabling ransomware and malware campaigns to persist among thousands of routine, compliant virtual machine instances. As a result of these findings, the hosting ecosystem is facing a broader structural challenge.
Because virtualization platforms reduce infrastructure deployment barriers, security responsibility is increasingly shifting away from providers, resellers, and enterprise customers to ensure that template hygiene is implemented effectively, unique system identifiers are enforced, and anomalous clustering patterns are monitored.
As a result of proactive hostname randomization, stronger customer vetting, transparency in abuse response, and cross-industry intelligence sharing, threat actors may be less likely to use templated infrastructure.
As demonstrated by these consistent artifacts exposed in the campaign, even commoditized infrastructure leaves discernible patterns behind.
It will not be sufficient to dismantle individual malicious nodes. Instead, it will be necessary to address the systemic weaknesses that allow legitimate technology to be silently adapted for large-scale, persistent cybercrime operations.
