Full Report
Ransomware operators are hosting and delivering malicious payloads at scale by abusing virtual machines (VMs) provisioned by ISPsystem, a legitimate virtual infrastructure management provider. [...]
Analysis Summary
# Tool/Technique: ISPsystem VM Template Abuse for Payload Delivery
## Overview
Ransomware operators and various malware campaigns are abusing default templates within ISPsystem's VMmanager virtualization platform to host and deliver malicious payloads at scale. The consistent reuse of identical hostnames and system identifiers across newly provisioned Windows VMs provides a layer of camouflage, confusing attribution efforts and slowing down takedown procedures by blending malicious infrastructure with legitimate user deployments.
## Technical Details
- Type: Technique (Abuse of legitimate infrastructure/Default configuration misuse)
- Platform: Windows VMs (utilizing ISPsystem VMmanager)
- Capabilities: Low-cost, fast, turnkey deployment of infrastructure for C2 and payload delivery; obfuscation through shared system identifiers.
- First Seen: Implicitly recent, based on investigation of recent 'WantToCry' incidents ending February 5, 2026.
## MITRE ATT&CK Mapping
- TA0011 - Command and Control
- T1071 - Application Layer Protocol
- T1071.001 - Web Protocols (Likely used for C2/Delivery)
- TA0010 - Exfiltration
- T1041 - Exfiltration Over C2 Channel (Possible, depending on C2 function)
- TA0005 - Defense Evasion
- T1562.001 - Impair Defenses (Hiding within legitimate infrastructure)
- T1036 - Masquerading
- T1036.005 - Match Legitimate Name or Location (Using default, non-specific identifiers)
## Functionality
### Core Capabilities
- **Stealthy Payload Hosting:** Utilizing provisioned, ephemeral VMs to host and serve malware payloads.
- **Infrastructure Elasticity:** Rapidly spinning up and likely tearing down infrastructure to support operations.
### Advanced Features
- **Identifier Overlap:** Exploiting the reuse of the same hostname and system identifiers across different deployments of the default Windows VM template, effectively cloaking malicious systems among legitimate ones.
- **Attribution Confusion:** The shared, non-randomized identifiers complicate efforts to trace infrastructure back to specific threat actors quickly.
- **Bulletproof Hosting:** Leveraging hosting providers known to ignore takedown requests to maintain persistence.
## Indicators of Compromise
- File Hashes: N/A (Focus is on infrastructure/platform configuration, not specific malware binaries, though associated files would exist.)
- File Names: N/A (Focus is on shared system identifiers)
- Registry Keys: N/A
- Network Indicators: N/A (Focus is on the hosting environment structure)
- Behavioral Indicators: Consistent use of default or identical hostnames across unrelated customer environments, especially linked to known criminal activity.
- **Prevalent Hostnames Observed:**
- WIN-LIVFRVQFMKO
- WIN-344VU98D3RU
- WIN-J9D866ESIJ2
## Associated Threat Actors
The technique/infrastructure has been observed in campaigns related to:
- WantToCry ransomware
- LockBit
- Qilin
- Conti
- BlackCat/ALPHV
- Malware campaigns involving RedLine info-stealer
- Malware campaigns involving Lummar info-stealer
## Detection Methods
- **Signature-based detection:** Ineffective against the delivery mechanism itself, though effective against the specific *payloads* launched from these VMs.
- **Behavioral detection:** Monitoring for clusters of infrastructure (VMs) sharing identical, non-randomized system identifiers (like hostnames) that are communicating in ways indicative of C2 or payload distribution.
- **YARA rules:** N/A for the infrastructure abuse itself.
## Mitigation Strategies
- **Platform Patching (ISPsystem):** ISPsystem has addressed this by releasing an update that randomizes hostname assignment upon new VM deployment.
- **Hosting Provider Vetting:** Consumers of hosting services should avoid providers known to tolerate or facilitate cybercriminal activity (e.g., Stark Industries Solutions Ltd., Zomro B.V., First Server Limited, Partner Hosting LTD, MasterRDP).
- **Infrastructure Monitoring:** Security teams should look for incoming or outgoing connections originating from VMs with suspiciously identical or default identifiers, particularly if associated with known threat actor infrastructure.
## Related Tools/Techniques
- Use of other legitimate cloud services for C2/Staging (e.g., using public file hosting services, legitimate collaboration tools).
- Exploitation of template/default configurations in other virtualization environments.
- Infrastructure abuse targeting cloud providers (e.g., the abuse of exposed RDP services mentioned in relation to MasterRDP).