Researchers Uncover Widespread Abuse of Virtual Machine Hosting by Cybercriminals

CyberDefender 8 mins0

In early 2026, researchers published a comprehensive investigation into how cybercriminals are leveraging legitimate virtual machine (VM) infrastructure at scale for malicious operations. Their analysis reveals that cyber actors are not just using conventional malware, but co-opting virtual servers from legitimate providers to support ransomware command-and-control, botnet management, malware delivery, and other facets of modern cybercrime.

1. Background: Virtual Machines and Hosting Providers

Virtual machines are abstracted computing environments that run guest operating systems on a hypervisor layer hosted by a physical server. This infrastructure underpins public cloud services and numerous hosting environments worldwide, offering scalability and flexibility for legitimate commercial applications.

However, bulletproof hosting (BPH) providers—hosting companies with lax oversight and a tolerance for abuse—are exploiting this infrastructure to supply inexpensive VM instances to cybercriminal operators. These services often turn a blind eye to illicit activity, providing offenders with a safe haven for deploying attacks.

2. How Malicious Use Was Identified

The CTU analysts began their investigation with specific WantToCry remote ransomware incidents in late 2025. In each case, attackers had used Windows-based VMs exhibiting auto-generated NetBIOS hostnames derived from default templates provided by ISPsystem’s VMmanager—a legitimate virtualization management platform used by many hosting providers.

Here’s what the researchers discovered:

  • Multiple internet-exposed VM instances were linked by the same static hostnames, despite being geographically and operationally distinct.
  • These hostnames, such as WIN-J9D866ESIJ2 and WIN-LIVFRVQFMKO, were associated not only with WantToCry, but also with multiple separate ransomware families including LockBit, Qilin, and BlackCat/ALPHV.
  • Third-party telemetry and threat intelligence showed these identical hostnames present across thousands of internet-exposed machines, especially in regions like Russia and Eastern Europe, indicating large-scale reuse of template VMs.

3. How Template Reuse Enables Criminal Operations

The crux of the problem stems from how these bulletproof hosting providers deploy Windows VMs:

Static Hostnames from Templates

VMmanager’s default Windows images include preconfigured NetBIOS hostnames and self-signed certificates that do not randomize identifiers upon deployment. When multiple customers – including cybercriminals – spin up servers using the same template, every instance inherits identical hostnames.

Operational Cover for Criminal Traffic

  • These shared identifiers make unrelated threat actors appear to be using a common infrastructure backbone.
  • To external observers, this can look like a massive botnet or a large-scale coordinated campaign.
  • In reality, it’s a side-effect of reused VM templates across providers that are catering to abuse-tolerant clients.

4. Quantifying the Scope of Abuse

Through tools like Shodan and other internet scanning methods, CTU researchers found:

  • 3,000+ live hosts using one Windows template.
  • Nearly 8,000 hosts using another template.

These instances were not clustered under a single provider, but spread across multiple bulletproof networks such as:

  • Stark Industries Solutions Ltd
  • First Server Limited
  • Zomro B.V.
  • Partner Hosting LTD
  • JSC IOT
    (among others)

Importantly, although VMs using these hostnames may sometimes host legitimate workloads, a significant portion were involved in ransomware C2 infrastructure, malware distribution, phishing infrastructure, and remote access trojans.

5. Why This Problem Is Hard to Mitigate

Multiple factors complicate defenses:

1. Legitimate Management Platforms

ISPsystem VMmanager and other virtualization frameworks are widely used by legitimate hosting companies, meaning detection based on software signatures alone is unreliable.

2. Template-Driven Reuse

Because prebuilt templates embed static identities, any automation that doesn’t sanitize or randomize settings will reproduce the same identifiers across deployments—magnifying correlations.

3. Bulletproof Hosting Incentives

Providers who profit from high churn, lax monitoring, and quick provisioning are unlikely to implement robust abuse controls without external enforcement.

4. Attribution Challenges

Identical hostnames across thousands of servers obscure which threat actors are responsible for specific malicious actions, complicating mitigation and takedown efforts.

6. Broader Security Implications

This case highlights a broader trend in cybercrime:

  • Cybercriminals increasingly rent VM infrastructure from low-oversight hosting services rather than building and maintaining their own physical servers.
  • Abusive VM deployment allows attackers to scale rapidly while blending into legitimate infrastructure.
  • Dynamic provisioning with minimal oversight creates environments where ransomware gangs, botnet operators, and malware distributors can experiment and adapt quickly.

7. Mitigation Strategies for Defenders

Although technical controls alone cannot solve the underlying incentives, defenders can take practical steps:

Network and Endpoint Monitoring

  • Use advanced telemetry to detect patterns indicative of VM misuse, such as unexpected RDP exposures, repeated connections from identically named hosts, and uncommon administrative access patterns.

Threat Intelligence Correlation

  • Integrate phishing, ransomware, IP reputation, and VM identifier feeds to flag suspicious infrastructure.

Provider Engagement

  • Collaborate with upstream cloud and hosting providers to enforce terms of service that preclude abuse.

Automated Configuration Hygiene

  • Ensure provisioning tools randomize critical identifiers (hostnames, certificates) to reduce artifact reuse in abusive deployments.

Conclusion

The investigation into the malicious use of virtual machine infrastructure reveals a significant evolution in cybercriminal infrastructure strategy. By leveraging bulletproof hosting services and prebuilt VM templates, attackers can rapidly scale malicious operations while obscuring attribution. For security professionals, this trend underscores the importance of sophisticated monitoring, multi-vector threat intelligence, and proactive engagement with service providers to detect, disrupt, and remediate abuse at scale.

CyberDefender