Microsoft has launched an international campaign to bring down RedVDS, an online crime platform that facilitated millions of people in fraction-of-a-cent virtual servers.
The operation, announced on January 14, targeted the platform used by criminals for phishing and scams.
How RedVDS Powered Global Fraud
The RedVDS service provided subscription services from 2019 for as low as $24 a month.
The service provided virtual computers that could be disposed of. The punters used the virtual computers for their activities.
Phishing campaigns were conducted through the service.
The attacker’s name given by Microsoft was Storm-2470. The service attacked 191,000 organizations across the world.
The service leased its servers in the U.S., the U.K., Canada, France, the Netherlands, and Germany.
This made it easier for hackers to evade filtering systems in place for securing these platforms.
Since March 2025, the reported fraud losses in the U.S. associated with RedVDS activities amount to $40 million, but the actual losses could be greater.
“Services of this type have become a propelling force for actual growth in cybercrimes,” stated Steven Masada, Microsoft’s Digital Crime Unit’s assistant general counsel.
Coordinated Takedown Across Borders
Microsoft initiated civil cases in the U.S. and, for the first time, in the U.K. to seize the RedVDS domain names.
A court in Florida authorized the seizure of two domain names that were hosting the marketplace service and customer portal.
Servers hosting the service were seized by the Germans.
Europol assisted this effort, with a role in discrediting payment networks for this crime.
The operation lacked any arrests, although Microsoft plans on uncovering those who created RedVDS.
Two of the victims were so fed up with their experiences with Microsoft that they sued together in a lawsuit as co-plaintiffs.
Alabama-based H2 Pharma lost $7.3 million to a payment diversion scam. The Gatehouse Dock Condominium Association in Florida lost
Timeline of RedVDS Rise and Fall
RedVDS started its operations in 2019, hosting servers across several global locations.
However, by 2025, RedVDS emerged as an important cybercriminal platform for hackers such as Storm-0259 and Storm-1575.
A threat intelligence from Microsoft identified RedVDS’s spread during the early months of 2025.
Research showed it was used in thousands of attacks. The market went offline on January 14.
Impact on Businesses and Future Defenses
The disruption hits sectors like real estate, healthcare, and construction hardest.
RedVDS enabled AI-enhanced scams, using tools for voice cloning and deepfakes.
Experts say such takedowns raise costs for criminals, though warn replacements may emerge. Microsoft calls for reporting fraud to aid investigations.
Next steps will include continued investigations into the operators of RedVDS, and Microsoft said it will notify those whose systems were compromised.
Law enforcement will be watching for similar services.
This is Microsoft’s 35th civil action against cybercrime infrastructure, the case reflects deepening private-public links in battling digital perils.
It is necessary for a business to harden its email security, adopt multi-factor authentication, and provide personnel training on phishing.
Tools such as Microsoft Defender can detect activity linked to RedVDS.
