Authorities Seize Virtualine Hosting Service in Cybercrime Investigation

Summary

U.S. and European authorities seized Virtualine’s primary domain and dozens of servers, taking hundreds of virtual servers offline. Authorities allege it enabled cybercrime; blockchain firms linked payments to ransomware and other illicit activity.

Key points

The FBI seized Virtualine’s primary domain in an investigation involving U.S., German, Dutch, and U.K. authorities and private-sector partners.
Dutch police said dozens of physical servers were seized in Limburg, taking hundreds of virtual servers offline; investigators recovered data on more than 3,000 customers, with follow-up action underway.
Authorities allege Virtualine facilitated ransomware, botnets, infostealers, phishing, and distribution of child abuse material since at least 2022. The operator rejected the allegation that it knowingly hosted a forum promoting child abuse material.
Chainalysis linked Virtualine payment addresses to ransomware operators and other illicit services. TRM said ransomware groups accounted for 5% of the service’s financial flows, while a Russian drug marketplace accounted for about 44%.
Researchers observed very low routing visibility for Virtualine’s network prefixes, though the hosting provider remained partially online.

Article Details

Event Type: Law enforcement seizure and disruption of a bulletproof hosting service associated with cybercrime.
Impact: The FBI seized Virtualine’s primary domain, and Dutch police reported seizing dozens of physical servers in Limburg, taking hundreds of virtual servers offline. Investigators recovered data relating to more than 3,000 customers, with follow-up action underway. Researchers observed that the service remained partially online but had very low routing visibility. Authorities allege the service facilitated ransomware, botnet, infostealer, phishing, and other criminal activity; Chainalysis linked its payment addresses to criminal operations, and TRM reported that ransomware groups accounted for 5% of its financial flows.

Malware

StealCTRM says that Virtualine also received payments from the StealC infostealer this year, with transactions indicating a constant financial relationship.

Vendors

VirtualinePolice seize Virtualine bulletproof service tied to ransowmare, cybercrime

Countries

GermanyFBI seized the primary domain of the service, virtualine[.net], following an investigation that involved Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the U.K.’s National Crime Agency, as well as Netherlandsthe service, virtualine[.net], following an investigation that involved Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the U.K.’s National Crime Agency, as well as private partners OverRIPE and United Kingdoman investigation that involved Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the U.K.’s National Crime Agency, as well as private partners OverRIPE and Lumen.United StatesU.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities.