Scworld

Ransomware Operators Exploit ISPsystem VMs for Malicious Payloads

First seen 6 Feb 2026, 22:23 UTC • Bleepingcomputer

•92% similarity •53.7

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Ransomware operators are leveraging virtual machines (VMs) provided by ISPsystem to host and distribute malicious payloads. Cybersecurity researchers at Sophos identified this tactic during their investigation of recent 'WantToCry' ransomware incidents, noting the use of Windows VMs with identical hostnames, indicative of default templates from ISPsystem's VMmanager.

ThreatCluster AI How this analysis works

Attack Flow

13 entities, 32 inferred relationships (STIX 2.1).

Technique (2)

Ransomware
T1071 - Application Layer Protocol

Malware (3)

Lummar
RedLine
Ursnif

Affected Platform (2)

Linux
Windows

Threat Actor (5)

BlackCat/ALPHV
Conti
Lockbit
Qilin
WantToCry

Tool (1)

VMmanager

Relationships

BlackCat/ALPHV uses Lummar
BlackCat/ALPHV uses RedLine
BlackCat/ALPHV uses Ursnif
Conti uses Lummar
Conti uses RedLine
Conti uses Ursnif
Lockbit uses Lummar
Lockbit uses RedLine
Lockbit uses Ursnif
Qilin uses Lummar
Qilin uses RedLine
Qilin uses Ursnif
WantToCry uses Lummar
WantToCry uses RedLine
WantToCry uses Ursnif
BlackCat/ALPHV uses VMmanager
Conti uses VMmanager
Lockbit uses VMmanager
Qilin uses VMmanager
WantToCry uses VMmanager
BlackCat/ALPHV uses Ransomware
BlackCat/ALPHV uses T1071 - Application Layer Protocol
Conti uses Ransomware
Conti uses T1071 - Application Layer Protocol
Lockbit uses Ransomware
Lockbit uses T1071 - Application Layer Protocol
Qilin uses Ransomware
Qilin uses T1071 - Application Layer Protocol
WantToCry uses Ransomware
WantToCry uses T1071 - Application Layer Protocol
BlackCat/ALPHV related to Linux
BlackCat/ALPHV related to Windows

Community

Browse all →

Tracked Entities in This Story

BlackCat/ALPHV Conti Lockbit Qilin WantToCry Lummar RedLine Ursnif Linux Windows

Ransomware Operators Exploit ISPsystem VMs for Malicious Payloads

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story