Ransomware gang uses ISPsystem VMs for stealthy payload delivery
By abusing virtual machines (VMs) provided by ISPsystem, a reputable virtual infrastructure management provider, ransomware perpetrators are hosting and distributing malware payloads at scale.
While looking into recent "WantToCry" ransomware incidents, researchers at cybersecurity firm Sophos noticed the strategy. They discovered that the attackers employed Windows virtual machines (VMs) with the same hostnames, indicating that ISPsystem's VMmanager had produced default templates.
Further investigation revealed that the identical hostnames were found in the infrastructure of other ransomware operators, such as LockBit, Qilin, Conti, BlackCat/ALPHV, and Ursnif, as well as several malware operations including RedLine and Lummar info-stealers.
ISPsystem is a reputable software firm ...