RedVDS Cybercrime Service Disrupted by Microsoft and Law Enforcement

Microsoft announced on Wednesday that it has teamed up with law enforcement to target RedVDS, a cybercrime service that has facilitated a wide range of malicious activities. Launched in 2019, RedVDS is a virtual dedicated server service that enables threat actors to set up disposable Windows-based RDP servers for mass phishing, BEC attacks, financial fraud and account takeover, with subscriptions from as little as $24 per month and reported US fraud losses totalling $40 million.

According to Microsoft, cybercriminals have used RedVDS to target organisations in the United States, the United Kingdom, Canada, France, Germany and Australia across sectors such as legal, manufacturing, healthcare, real estate, construction and education, with the threat group Storm-2470 identified as operating and developing RedVDS. Microsoft linked many attacks to RedVDS by the shared Windows base, noting that the servers were created from a single Windows Server 2022 image and repeatedly cloned.

The company also disclosed that in one month, 2,600 RedVDS virtual machines were sending around one million phishing emails per day, and that since September 2025, RedVDS-enabled attacks have compromised or fraudulently accessed more than 191,000 Microsoft email accounts across over 130,000 organisations, leading to seizures of domains, key servers and payment networks as part of an international disruption.