The “Bulletproof” Shadow: How Hackers Hijacked ISPsystem

Legitimate infrastructure is the new invisibility cloak for ransomware.

On February 4, 2026, a major investigation confirmed what many SOC teams had suspected but struggled to prove:

Elite cybercriminal groups have moved beyond building malicious infrastructure.

Instead, they are hijacking legitimacy itself.

Attackers are now abusing ISPsystem (a hosting control platform used by cloud and VPS providers) and its VMmanager virtualization software to deploy pre-poisoned virtual machines that quietly power global ransomware operations.

No shady domains.
No obvious malware servers.
Just clean-looking infrastructure doing very dirty work.

---

The Discovery: Why the “Shadow” Is Dangerous

Researchers observed that multiple high-profile attacks — including campaigns linked to LockBit and Qilin — were launched from Windows virtual machines with autogenerated NetBIOS hostnames such as:

WIN-LIVFRVQFMKO

At first glance, this looks harmless.

That’s exactly why it works.

These hostnames are not random. They are the default naming templates generated by ISPsystem during VM provisioning.

Because thousands of legitimate businesses use the same templates, these systems blend perfectly into normal internet noise. To most SOC tools, they look like just another hosting customer.

If the server looks like a standard ISP deployment, most firewalls let the traffic pass.

This is the Bulletproof Shadow.

---

The Anatomy of the Hijack

This is not a zero-day frenzy. There is no dramatic breach.

This is a Resource Development play.

Instead of building their own infrastructure, attackers acquire access through “bulletproof” hosting resellers that:

• operate legitimate ISPsystem VMmanager installations
• resell access with minimal verification
• sit inside trusted ISP autonomous systems (ASNs)

Nothing is “hacked” at this stage.

The attacker is now simply a customer.

---

ATTACKER WALKTHROUGH: How This Looks From the Hacker’s Side

To understand why this attack works, you have to stop thinking like a defender.

Think like a ransomware operator planning infrastructure in 2026.

---

Phase 1: Infrastructure That Will Not Get Blocked

The attacker’s first goal is not speed.

It’s longevity.

Instead of renting a suspicious VPS, the operator uses a bulletproof hosting reseller running ISPsystem. Access is purchased, not exploited.

No intrusion. No alerts.

At this point, the attacker is indistinguishable from a legitimate hosting customer.

---

Phase 2: Abuse the Defaults

Inside ISPsystem VMmanager, the attacker provisions a VM exactly the way a real admin would:

• OS: Windows Server 2019 / 2022
• Template: Default ISPsystem image
• Hostname: Auto-generated

WIN-LIVFRVQFMKO

This is critical.

Thousands of legitimate customers use the same hostname pattern. Many SOCs explicitly ignore autogenerated Windows hostnames because they are so common.

The VM automatically inherits:

• Clean IP reputation
• Trusted ISP ASN
• Normal reverse DNS
• Standard Windows services (SMB, RDP, WinRM)

Nothing here looks malicious.

---

Phase 3: Turning the VM Into a “Clean” Control Node

The attacker installs only tools that defenders hesitate to block.

NetSupport RAT

• Signed binaries
• Legitimate remote IT support software
• Often already whitelisted
• Runs as client32.exe
• Communicates over common ports (443 / 80)

From the attacker’s point of view:

“If they block this, they’ll break their own IT team.”

PixyNetLoader

• Lightweight loader
• Minimal disk artifacts
• Used as a relay or staging component

No cracked malware. No loud beacons.

This VM now acts as:

• C2 relay
• Phishing payload host
• Credential collection endpoint
• Ransomware staging server

---

Phase 4: Reputation as a Shield

When victim systems connect back to this VM:

• Destination IP → legitimate ISP
• Hostname → matches ISPsystem default format
• TLS → valid certificates
• Traffic → HTTPS, low volume, business hours

From a SOC dashboard:

Outbound HTTPS to hosting provider
Risk score: Low

No alerts fire.

The infrastructure is bulletproof not because it is hidden — but because it looks too normal to question.

---

Phase 5: Launching the Ransomware Operation

Once inside the victim network:

1. Credentials are harvested
2. Lateral movement begins
3. Data is staged for exfiltration
4. Ransomware (LockBit / Qilin) is deployed internally

After the operation:

• The VM is destroyed
• A new VM is provisioned
• Same template
• New clean IP

The cycle repeats.

---

MITRE ATT&CK: Breaking Down the Shadow

Tactic	Technique ID	How It’s Used
Resource Development	T1583.003	Acquiring “bulletproof” VPS infrastructure
Defense Evasion	T1070	Blending in with default ISPsystem hostnames
Persistence	T1219	NetSupport RAT for long-term access
Command & Control	T1105	Using legitimate ISP-owned IP ranges

---

SOC Blueprint: Detecting the Invisible

Legitimate does not mean safe.

High-Signal Detection Ideas

• Hostname Watch: Monitor external hosts matching WIN-[A-Z0-9]{11}
• NetSupport Anomaly: Alert on client32.exe unless explicitly deployed
• ASN Reality Check: Stop blindly trusting hosting reputation

---

The Final Verdict

As we warned in The Notepad++ Siege, the most dangerous attacks in 2026 are not exploit-driven.

They are trust-driven.

When attackers stop breaking in and start subscribing to the same tools we use, the line between IT operations and cybercrime disappears.

This is the Bulletproof Shadow — and it is already inside the infrastructure we trust most.

Stay Alert. Stay Human. Stay Safe.
— ZyberWalls Research Team