US seizes Virtualine bulletproof hosting domain used by cybercriminals
Original title: Officials seize domain of top bulletproof hosting provider Virtualine
TRM Labs says the provider took nearly one-fifth of tracked illicit bulletproof-hosting inflows in 2026, and the seizure may not kill the infrastructure.
The Justice Department said Tuesday that authorities seized the primary domain of Virtualine, also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech. Prosecutors said customers used it for a large-scale sextortion scheme, ransomware, data theft, malware hosting, money laundering and CSAM distribution. TRM Labs said Virtualine received the most illicit-attributed value among tracked bulletproof hosts in 2026 to date, but a domain seizure does not by itself prove the operator stopped or that all infrastructure is offline.
Unconfirmed: TRM Labs says the seizure disrupts access but does not establish that operators or all infrastructure stopped.
- TRM said a Russian drug marketplace was nearly 44% of direct payments to Virtualine.
- A sextortion scheme was nearly 17% of payments, a mixer almost 13%, and ransomware nearly 5%.
- Named paying ransomware groups include Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin.
- Payments also came from StealC and the Matanbuchu loader, TRM said.
- Officials said hosting continued after notices from Germany, Canada, Australia and NCMEC.
Impact: Criminal customers used the host for extortion, ransomware, theft and malware
- Threat actors
- Coinbase CartelThe GentlemenINCDragonForceQilin
- Malware
- StealCMatanbuchu
From the original article
3 min read at cyberscoop.com
The Russian-speaking cybercrime storefront was among the most active bulletproof hosting providers this year to date, receiving almost one-fifth of all illicit-attributed inflow tracked by researchers. The post Officials seize domain of top bulletproof hosting provider Virtualine appeared first on CyberScoop.
By Matt Kapko · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.