ThreatCluster

Abuse of Virtual Machine Infrastructure by Cybercriminals

First seen 4 Feb 2026, 20:59 UTC •Blogs.SophosSophos •24

Article Content

Browse articles
ThreatCluster

Cybercriminals are exploiting virtual machine infrastructure provided by bulletproof hosting providers. These providers are misusing legitimate ISP systems to supply virtual machines, facilitating various cybercrimes, including ransomware attacks. The Counter Threat Unit™ (CTU) has identified multiple internet-exposed devices involved in this malicious activity.

How this analysis works

Extracted Entities

1 / 2