Threat reportThreat IntelligenceTL-2026-4561
Operation Omegaline: FBI Seizes virtualine.net, Disrupting Omegatech / Virtualine Technologies Bulletproof Hosting (AS202412)
Operation Omegaline (TL-2026-4561), also tracked as Operation Omegaline, is a medium-severity tracked intrusion set, first published 2026-10-27. It has no confirmed attribution, affects Virtualine Technologies / Omegatech LTD Bulletproof hosting, maps to 9 MITRE ATT&CK techniques (T1059.001, T1106, T1204.004), and is covered by 9 detection rules and 17 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 9MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 17Indicators of compromise
Key facts for TL-2026-4561
- Threat ID
- TL-2026-4561
- Also known as
- Operation Omegaline
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, finance
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
How Operation Omegaline works
On 2026-10-27 the FBI seized virtualine.net under Operation Omegaline, announced by the US Attorney's Office for the Eastern District of Virginia. Virtualine Technologies, which also operated as Omegatech (AS202412), sold bulletproof hosting to cybercriminals; Silent Push reports Omegatech is not fully offline and its prefixes show very low routing visibility.
Operation Omegaline is a multinational law-enforcement action against Virtualine Technologies, a bulletproof hosting (BPH) provider that also operated as Omegatech. The FBI Washington Field Office led the investigation; the US Attorney's Office for the Eastern District of Virginia announced the seizure of the virtualine.net domain on 2026-10-27. Partners named in the Silent Push write-up are Germany's Polizei Hessen, the Netherlands' Politie Midden-Nederland, the UK National Crime Agency, OverRIPE and Lumen. Silent Push describes the hosting as supporting phishing, malware and ransomware infrastructure generically; no specific malware family or threat actor is named in the primary source.
Routing and ownership history: throughout 2025 Railnet LLC (AS214943) provided the routing backbone for infrastructure used by Virtualine Technologies, letting it operate without directly owning IP space. Per Recorded Future Insikt Group (as summarised by secondary sources), announcements shifted to AS202412 Omegatech LTD as early as 2026-01-21, and Insikt assesses with high confidence that Omegatech LTD is operated by Virtualine. Silent Push independently detected the Railnet-to-Omegatech infrastructure shift on 2026-02-11, using 91.92.240.5 as an example (on BPH feeds since 2025-10-22). Per the Justice Department as quoted by Silent Push, in March 2026 Virtualine advertised an 'additional protection plan' that moved customers' criminal infrastructure, including to shell companies. The model enables frequent rotation of short-lived prefixes, complicating attribution and prolonging the lifespan of malicious infrastructure.
Observed customer abuse (independent researcher write-up, lower confidence): Virtualine/Omegatech address space was used in a ClickFix campaign. A compromised Brazilian site (absoluteinvestimentos.com.br, 191.233.203.32) presented a fake Cloudflare Ray ID verification page that led victims to run an obfuscated PowerShell (IEX/IRM) stage from 91.92.240.121, which fetched a position-independent shellcode binary ('s_enterprise') from 158.94.208.104 and executed it in memory via VirtualAlloc, Marshal.Copy and CreateThread. BeaconBeagle returned HTTP 404 for 91.92.240.5, so no C2 correlation could be recorded.
Status: Silent Push states Omegatech is not fully offline and its prefixes show very low routing visibility. Silent Push notes that a BPH can have a new ASN issued in two to five business days and that 50 of the BPH providers it tracks lost their ASNs, so re-emergence under new ASNs/shell companies is expected. Wider context: May 2026 Dutch FIOD seizure of 800+ servers (THE.Hosting/WorkTitans BV, AS209847); July 2026 US charges against three Russian nationals over BPH services and EU sanctions on Media Land and ML Cloud (2026-07-13); OFAC sanctions on Aeza Group (2025-07-01). The justice.gov announcement was not independently retrieved.
MITRE ATT&CK techniques used in TL-2026-4561
Execution
T1059.001 PowerShell; T1106 Native API; T1204.004 Malicious Copy and Paste
Command and Control
T1568.001 Fast Flux DNS; T1665 Hide Infrastructure
Resource Development
T1583.001 Domains; T1583.003 Virtual Private Server; T1583.004 Server; T1584.004 Server
Affected products and versions in Operation Omegaline
- Virtualine Technologies / Omegatech LTD — Bulletproof hosting infrastructure (AS202412, AS214943)
Remediation for Operation Omegaline
Immediate actions
- Block or alert on traffic to/from AS202412 (Omegatech), AS214943 (Railnet LLC) and the listed IPs; review historical logs for contact
- Hunt egress logs for connections to 91.92.240.5, 91.92.240.121 and 158.94.208.104
- Add virtualine.net to DNS blocklists and review historical resolutions
Workarounds
- Use PowerShell Constrained Language Mode and script block logging to limit and detect ClickFix-delivered stagers
Longer-term hardening
- Subscribe to bulletproof-hosting ASN/prefix feeds and refresh blocking as operators re-emerge under new ASNs and shell companies
- Apply the CISA et al. 'Bulletproof Defense' guidance for mitigating risk from bulletproof hosting providers
- Train users to recognise ClickFix fake verification pages and restrict paste-and-run into Run dialogs/PowerShell
Timeline of Operation Omegaline
- US Treasury OFAC sanctioned Aeza Group, part of the wider 2025-2026 pressure on bulletproof hosting providers.
- 91.92.240.5 began to be tracked on Silent Push bulletproof hosting feeds.
- CISA, UK NCSC, AWS, RedSense and partners published the 'Bulletproof Defense' joint guidance on mitigating risks from bulletproof hosting providers.
- Per Recorded Future Insikt Group (secondary report), Virtualine infrastructure began being announced from AS202412 Omegatech LTD, moving off Railnet LLC (AS214943).
- Silent Push detected the infrastructure shift from Railnet LLC to the newly registered Omegatech ASN.
- March 2026 (exact day not stated): per the Justice Department, Virtualine advertised an 'additional protection plan' that moved customers' criminal infrastructure, including to shell companies.
- May 2026 (exact day not stated): Dutch FIOD seized 800+ servers and arrested two individuals in the THE.Hosting/WorkTitans BV (AS209847) action.
- EU sanctioned Media Land, ML Cloud and director Aleksandr Volosovik; July 2026 also saw US charges against three Russian nationals over BPH services.
- FBI seized virtualine.net under Operation Omegaline, announced by the US Attorney's Office for the Eastern District of Virginia; Silent Push reported Omegatech not fully offline with very low prefix routing visibility.
Sources cited for Operation Omegaline
- Silent Push: Omegatech Is Disrupted, and the Pressure on Bulletproof Hosting Keeps Building
- CISA et al.: Bulletproof Defense - Mitigating Risks From Bulletproof Hosting Providers
- Virtualine ClickFix attribution (0xdevbot)
- Intel 471: A new era of bulletproof hosting providers emerge
- Spamhaus: Bulletproof hosting - there's a new kid in town
- ThreatFox: ASN 214943 (Railnet LLC) IOCs
- ASD ACSC: Bulletproof hosting providers
Detection coverage for TL-2026-4561
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4561 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4561
2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.