Authorities Seize Virtualine Domain Used by Cybercriminals
Summary
U.S. authorities seized Virtualine’s primary domain over its alleged role in criminal activity. TRM Labs says the service drew substantial illicit-attributed crypto payments; the seizure disrupted access but did not establish a full shutdown.
Key points
- The FBI and prosecutors obtained a court order to seize Virtualine’s primary domain; the service was also known as Secury, Massgod, Spamhouse, Lanedo and Omegatech.
- The Justice Department said Virtualine supported criminal activity including sextortion, ransomware, data theft, malware hosting, money laundering and CSAM distribution.
- TRM Labs reported that Virtualine received the most illicit-attributed value in 2026 to date among the bulletproof hosting providers it tracked, accounting for nearly one-fifth of their illicit-attributed inflows.
- TRM said ransomware groups including Coinbase Cartel, The Gentlemen, INC, DragonForce and Qilin paid Virtualine’s operators.
- Authorities said Virtualine continued hosting a CSAM distributor and a hack-for-hire service after receiving law-enforcement notices.
- TRM said the domain seizure disrupted how customers found and accessed the service, but did not establish that its operators stopped or that all underlying infrastructure became inaccessible.
Article Details
- Event Type
- Law enforcement seizure of the primary domain of Virtualine, a bulletproof hosting provider.
- Impact
- The FBI and prosecutors obtained a court order to seize Virtualine’s primary domain. TRM Labs reported that the seizure disrupted how customers find and access the service, but did not establish that its operators stopped working or that all underlying infrastructure became inaccessible. The Justice Department said Virtualine had facilitated criminal activity including sextortion, ransomware, data theft, malware hosting, money laundering, and distribution of child sexual abuse material.
People
Threat Actors
Coinbase CartelTRM Labs reported that this ransomware group paid Virtualine’s operators.DragonForceTRM Labs reported that this ransomware group paid Virtualine’s operators.INCTRM Labs reported that this ransomware group paid Virtualine’s operators.QilinTRM Labs reported that this ransomware group paid Virtualine’s operators.The GentlemenTRM Labs reported that this ransomware group paid Virtualine’s operators.
Malware
MatanbuchuThe bulletproof hosting provider also received payments from the StealC infostealer, the Matanbuchu loader, bot and malware-distribution services and sites linked to CSAM.StealCThe bulletproof hosting provider also received payments from the StealC infostealer, the Matanbuchu loader, bot and malware-distribution services and sites linked to CSAM.
Countries
Australiaand a hack-for-hire service after it received numerous notices from law enforcement in Germany, Canada, Australia, the National Center for Missing and Exploited Children and a victim’s attorney.CanadaCSAM and a hack-for-hire service after it received numerous notices from law enforcement in Germany, Canada, Australia, the National Center for Missing and Exploited Children and a victim’s attorney.Germanydistributed CSAM and a hack-for-hire service after it received numerous notices from law enforcement in Germany, Canada, Australia, the National Center for Missing and Exploited Children and a victim’s attorney.Russia“Virtualine is another example of Russia’s illicit economy at work: darknet markets, ransomware groups, non-compliant exchanges, and brokers all feeding the same ecosystem,” Ari Redbord, global head of policy at TRM