# Ransomware C2 Infrastructure Abuse — Bulletproof Hosting Procurement, VPS Exploitation, Hosting Panel Compromise, Cobalt Strike on Legitimate Infrastructure, Multi-Jurisdictional Takedown Complexity

> Ransomware groups systematically abuse legitimate hosting and virtual machine infrastructure for stealthy command-and-control (C2) operations. Rather than operating dedicated malicious infrastructure, modern ransomware-as-a-service (RaaS) ecosystems procure VPS instances from legitimate hosting providers, abuse compromised hosting panels, and leverage bulletproof hosting services that operate within legitimate ISP networks. This 'living off the infrastructure' approach makes C2 traffic indistinguishable from legitimate customer workloads, defeats IP reputation-based blocking, and complicates law enforcement takedown operations. Documented by CISA across multiple #StopRansomware advisories: LockBit affiliates used compromised VPS and legitimate hosting for C2 (AA23-165a), BianLian used Ngrok reverse proxy and Rsocks SOCKS5 tunnels (AA23-136a), Black Basta leveraged Cobalt Strike on legitimate infrastructure (AA24-131a). The Conti leaks (2022) revealed internal procurement of hosting services from Russian-language forums. ISPsystem (Russian, est. 2004, VMmanager/DCImanager/BILLmanager, 200K+ servers, 100+ countries) represents the class of hosting management platforms that enable rapid VM provisioning — the same capability ransomware operators exploit when they gain access to hosting provider panels. ⚠️ V1 CORRECTION: The original v1 title 'Ransomware Gangs Abuse ISPsystem VMs for Stealthy C2 Infrastructure' implied ISPsystem-SPECIFIC abuse — NO primary source documents this specific connection. The broader trend is real and well-documented; the ISPsystem-specific claim appears fabricated. V1 conflated a real product with a real trend to create a plausible but unverifiable narrative.

- **Published:** 2026-02-16T09:47:05Z
- **Last reviewed:** 2026-02-16T09:47:05Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0099
- **ID:** TL-2026-0099
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** LockBit (Russia)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Modern ransomware-as-a-service (RaaS) operations have evolved far beyond simple malware deployment. A critical but underreported component of successful ransomware campaigns is the infrastructure layer — the servers, VPS instances, and cloud resources that host C2 channels, staging servers, data exfiltration endpoints, and ransomware payload delivery systems.

Ransomware operators employ a spectrum of hosting strategies:

1. BULLETPROOF HOSTING: Services that explicitly or tacitly tolerate malicious activity, typically operating from jurisdictions with weak cybercrime enforcement. These providers often advertise on Russian-language cybercrime forums with guarantees of no-takedown policies. The Conti group's leaked internal communications (Feb 2022) revealed systematic procurement of hosting from multiple providers, with dedicated team members managing infrastructure procurement and rotation.

2. COMPROMISED HOSTING PANELS: Attackers gain access to hosting provider management panels (like VMmanager, cPanel, Plesk, or WHM) through stolen credentials or exploited vulnerabilities, then spin up new VMs on legitimate provider infrastructure. These VMs inherit the IP reputation and network trust of the legitimate hosting provider, making C2 traffic indistinguishable from normal customer workloads.

3. LEGITIMATE CLOUD ABUSE: Ransomware operators create accounts on major cloud providers (AWS, Azure, GCP, DigitalOcean, Linode, Vultr) using stolen or synthetic identities, cryptocurrency payment, and minimal verification. C2 infrastructure on these platforms benefits from the providers' high-reputation IP ranges.

4. REVERSE PROXY AND TUNNELING: Rather than hosting C2 directly, groups use services like Ngrok, Cloudflare Tunnels, or custom SOCKS5 proxies (like Rsocks) to relay C2 traffic through legitimate infrastructure. BianLian group was documented by CISA/FBI using modified Rsocks for SOCKS5 tunneling and Ngrok for reverse proxy C2.

5. COBALT STRIKE AND C2 FRAMEWORKS: Commercial and open-source C2 frameworks (Cobalt Strike, Brute Ratel, Sliver, Havoc) are deployed on legitimate hosting, with operators using domain fronting, malleable C2 profiles, and HTTPS encryption to blend with normal web traffic. LockBit, Black Basta, and BianLian affiliates all documented using Cobalt Strike beacons on legitimate infrastructure.

The hosting management platform ecosystem — including ISPsystem (VMmanager, DCImanager, BILLmanager), Virtuozzo, Proxmox, OpenStack, and similar platforms — enables rapid, automated VM provisioning that benefits both legitimate operators and threat actors. When credentials to hosting management panels are compromised (via phishing, credential stuffing, or exploitation), attackers can provision C2 infrastructure at scale on legitimate provider networks.

ISPsystem specifically: A Russian company founded in 2004, with software installed on 200,000+ servers across 100+ countries. VMmanager provides scalable VM provisioning, BILLmanager handles billing automation, DCImanager manages physical datacenter infrastructure. Their client base includes hosting providers, data centers, educational institutions, and financial organizations. While NO published research specifically documents ransomware abuse of ISPsystem-managed infrastructure, the platform represents the CLASS of hosting management tools that are inherently at risk when access credentials are compromised.

Law enforcement implications: Operation Cronos (LockBit takedown, Feb 2024) specifically targeted LockBit's hosting infrastructure, seizing 34 servers across multiple countries. The multi-jurisdictional nature of hosting infrastructure makes takedowns complex — servers in different countries require coordination across multiple legal frameworks.

The defensive challenge: Traditional IP blocklisting fails against C2 hosted on legitimate infrastructure. Network-based detection must shift from reputation-based approaches to behavioral analysis: anomalous DNS patterns, unusual data transfer volumes, beacon-like periodic communications, and TLS certificate analysis.

## MITRE ATT&CK

- T1583.003 Virtual Private Server
- T1583.004 Server
- T1584.004 Server
- T1588.002 Tool
- T1608.001 Upload Malware
- T1078 Valid Accounts
- T1059.001 PowerShell
- T1133 External Remote Services
- T1685 Disable or Modify Tools
- T1036 Masquerading
- T1003.001 LSASS Memory
- T1046 Network Service Discovery
- T1021.001 Remote Desktop Protocol
- T1071.001 Web Protocols
- T1572 Protocol Tunneling
- T1090.002 External Proxy
- T1219 Remote Access Tools
- T1105 Ingress Tool Transfer
- T1573.002 Asymmetric Cryptography
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1486 Data Encrypted for Impact
- T1583.005 Botnet
- T1583.006 Web Services
- T1095 Non-Application Layer Protocol
- T1001.003 Protocol or Service Impersonation
- T1205 Traffic Signaling
- T1566.002 Spearphishing Link

## Sources

- [CISA #StopRansomware: LockBit (AA23-165a) — 1,700 US attacks, $91M ransoms](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a)
- [CISA #StopRansomware: BianLian (AA23-136a) — Ngrok/Rsocks C2 tunneling](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-136a)
- [CISA #StopRansomware: Black Basta (AA24-131a) — 500+ victims, Cobalt Strike C2](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a)
- [ISPsystem — IT Infrastructure Management Platforms (200K+ servers)](https://www.ispsystem.com/)
- [ISPsystem VMmanager — Virtualization Management Platform](https://www.ispsystem.com/vmmanager)
- [ISPsystem News — no security incidents documented](https://www.ispsystem.com/news)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0099