Digital Economy

Microsoft dismantled the criminal infrastructure of RedVDS

It is a global cybercrime subscription service responsible for frauds that have caused millions of dollars in losses worldwide.

by Alessia Valentini

14 January 2026

3' min read

Translated by AI

Versione italiana

3' min read

Translated by AI

Versione italiana

It was announced today by Microsoft that it is taking coordinated legal action in the US and the UK against the online cybercrime service RedVDS. The initiative also benefits from close cooperation with international law enforcement agencies, including the German authorities and Europol, to actively fight and disrupt the network of servers hosting the criminal marketplace by seizing infrastructure.

Coordinated international law enforcement

Microsoft was able to count on two of RedVDS's many victims, the H2 pharmaceutical company and the Gatehouse Dock Condominium association, both based in America, to join as plaintiffs in a civil lawsuit against the cybercrime-as-a-service. Further efforts to thwart illicit operations were initiated in Germany where the German public prosecutor's office in Frankfurt am Main, the central office for combating cybercrime (ZIT) and the criminal police office of the German state of Brandenburg took the central RedVDS marketplace offline and seized a critical server. Europol's European Cybercrime Centre (EC3) was also involved in disrupting the extensive network of servers and payment networks.

What is Cybercrime-as-a-Service RedVDS service

For a $24/month online subscription, RedVDS provides criminals with access to disposable, scalable and hard-to-trace virtual computers used to fuel fraud, scams and other AI-based cyber attacks worldwide. The infrastructure is available as a Cybercrime-as-a-Service (CaaS) paid for by online subscription. The attacks are carried out by organised crime groups of professionals who intercept and manipulate legitimate communications on a large scale. Microsoft, when asked about possible evidence of motivation for the attacks linked to geopolitical destabilisation campaigns or funding of state-sponsored groups, stated that: "although we cannot state this with certainty, our research indicates that RedVDS is primarily used by actors with financial motivations".

The typical fraud schemes of criminals

The scams follow the pattern of the Business e-mail Compromise Fraud, also known as the CEO's scam, in which criminals first gain unauthorised access to e-mail accounts and monitor conversations; wait until just before a payment or transfer to pass themselves off as a trustworthy counterparty and redirect funds within seconds.

The other scheme used involves the real estate impersonation scam in which attackers compromise the accounts of real estate agents, escrow agents or real estate companies. They send timely and strategic e-mails with fraudulent payment instructions designed to hijack closing funds, escrow payments and other large transactions. The victims are first-time homebuyers, often families who suffer devastating consequences because a single hijacked payment is worth their life savings.

Which countries and sectors have been affected

Damages in America came to $40 million, a value observed directly by Microsoft, but it is plausible that the values are higher due to the low claims of the victims. The impact is widespread with 9,000 customers in Canada and America alone, but Microsoft reports damage in construction, manufacturing, healthcare, logistics, education, legal services and others. Italy has also been affected, so much so that it is ranked tenth on the global list of Microsoft accounts affected by RedVDS-facilitated cyber attacks: in the period between September 2025 and January 2026, RedVDS-facilitated cyber attacks compromised approximately 2480 e-mail accounts of Italian Microsoft customers in the consumer goods sector. Asked whether the Italian Cybersecurity Agency (ACN) was involved or is active in this operation, Microsoft stated: 'we are informing affected customers and collaborating with Europol, which is coordinating operations with member countries as needed', without further specifics on ACN's role.

Instructions to guard against scams

Measures can be taken to significantly reduce the risk by slowing down the urgency, recalling contact points using already known numbers, verifying payment requests using additional contact information and using multi-factor authentication systems. Reporting to the relevant authorities is also important, as part of threat sharing (info-sharing) and pre-alerting the security community.

Brand connect

I prossimi eventi

Tutti gli eventi

Notizie e approfondimenti sugli avvenimenti politici, economici e finanziari.

Technology