Inside RedVDS: How a single virtual desktop provider fueled worldwide cybercriminal operations

Over the past year, Microsoft Threat Intelligence has traced RedVDS, a virtual dedicated server provider used by multiple financially motivated threat actors to carry out business email compromise, mass phishing, account takeover and financial fraud, with attacks spanning the United States, Canada, United Kingdom, France, Germany, Australia and other banking-centric countries.

The operation is run through a single, cloned Windows image delivered via RDP, enabling criminals to spin up new hosts in minutes using the same base identity, including a shared host name WIN-BUNS25TD77J. RedVDS customers paid primarily in cryptocurrency, and the service boasted no usage caps or logs, attracting illicit use, while operators rented servers from third‑party providers to obscure origins and allow geolocation‑aware targeting.

Microsoft observed roughly US$40 million in fraud losses linked to RedVDS‑enabled activity in the United States alone since March 2025, underscoring the canny scalability of this infra structure for cybercriminal campaigns; the threat actors leveraged tools such as mass mailers, email harvesters and privacy/VPN apps to aid their campaigns.

The activity is attributed to a threat actor group dubbed Storm-2470, with claims of involvement also tied to other actors including Storm-0259, Storm-2227, Storm-1575 and Storm-1747, alongside phishing operators who used the RacoonO365 service prior to its takedown, according to Microsoft’s Digital Crimes Unit (DCU).