Cybercriminals Exploit Cheap Virtual Machines

Cybercriminals are taking advantage of inexpensive virtual machine hosting services to launch ransomware attacks, according to a recent study by Sophos. These services, often called bulletproof hosting providers, supply the infrastructure that lets these attackers run large-scale campaigns effortlessly. Sophos’ investigation found that these criminals misuse legitimate services, sidestepping the need to build their infrastructure from scratch.

Researchers discovered multiple ransomware incidents where attackers used Windows servers with the same hostnames. This pattern indicates a coordinated effort among cybercriminals utilizing identical preconfigured machine templates. Rather than a series of independent attacks, this network of criminals is automating their efforts, making these threats more persistent and widespread.

Key Findings on Ransomware Operations

Sophos’ research identified that these VMs, often created using ISPsystem’s VMmanager, share non-unique hostnames. This means thousands of servers appear identical on the internet. By using the Shodan search engine, researchers found tens of thousands of these servers, with the majority originating from just a few Windows templates. Moreover, many of these VMs are KSM-enabled, allowing Windows to run without a license during a prolonged trial.

The cybercriminals exploit bulletproof hosting companies that ignore abuse complaints, providing a haven for these activities. Some hosting providers, like Stark Industries Solutions and First Server Limited, have past ties with sanctioned entities. This highlights the ongoing challenge for cybersecurity professionals, emphasizing the need for organizations to continuously update their security strategies against the evolving tactics of cybercriminals.

Qsentinel: Stay vigilant against cyber threats. Regularly update and evaluate your security protocols to protect your digital infrastructure from the latest ransomware tactics.

Ready to take data security seriously?

Discover how Qsentinel can protect your organization against ransomware, enforce true data sovereignty, and stay ahead of the quantum threat. Their purpose-built workspace is designed for exactly that.

👉 Check out Qsentinel now and secure your future.