Microsoft Legal Action Disrupts RedVDS Cybercrime Infrastructure Used for Online Fraud

On 15 January 2026, Microsoft said it had taken a coordinated legal action in the United States and the United Kingdom to disrupt RedVDS, a cybercrime subscription service that allegedly generated millions in fraud losses, and to take its malicious infrastructure offline, in what it described as part of a broader law enforcement effort.

Microsoft said RedVDS provided criminals with access to disposable Windows-based virtual desktops for as little as US$24 a month, enabling cheap, scalable, and hard-to-trace fraud, and since March 2025 RedVDS-enabled activity had driven roughly US$40 million in reported fraud losses in the United States alone. The service advertised Windows Remote Desktop Protocol servers via platforms such as Discord, ICQ and Telegram, with a Telegram bot used to manage servers and without keeping activity logs.

RedVDS was founded in 2017 and launched in 2019, and Microsoft identified a global network of cybercriminals, including groups such as Storm-2470, Storm-2227, Storm-1575 and Storm-1747, that exploited its infrastructure to conduct phishing, BEC, account takeovers and other fraud across multiple sectors in the US, Canada, the UK, France, Germany, Australia and beyond.

The infrastructure reportedly spun up Windows Server 2022 image-based VMs via RDP, cloned from a single master image using QEMU, and offered a reseller panel and sub-user access to scale operations, with hosts located in countries including Canada, the US, the UK, and several European nations.