Ransomware gang uses ISPsystem VMs for stealthy payload delivery

Sophos researchers found that threat actors (including LockBit, Qilin, Conti, BlackCat/ALPHV, Ursnif, and operators of RedLine and Lummar) are exploiting ISPsystem VMmanager's default Windows VM templates—which reuse identical hostnames and system identifiers—to spin up VMs for C2 and delivery of ransomware and info-stealer payloads; the technique hides malicious systems among legitimate infrastructure and is concentrated in a small set of hosting providers that enable large-scale abuse.