Background and Timeline
On 14 January 2026, Microsoft announced a coordinated legal action in the US and UK to disrupt RedVDS, a global cybercrime subscription service responsible for millions in fraud losses. The takedown, conducted in partnership with international law enforcement agencies including Europol and German authorities, resulted in the seizure of key infrastructure and the shutdown of the RedVDS marketplace.
Modus Operandi
RedVDS operated as a cybercrime-as-a-service platform, offering disposable virtual computers (Windows RDP servers) for as little as $24 per month. These servers were used by cybercriminals worldwide to launch mass phishing campaigns, business email compromise (BEC) attacks, account takeovers, and payment diversion frauds. RedVDS enabled attackers to operate anonymously, scale their operations, and evade detection by law enforcement and security tools.
Victims and Financial Impact
Since March 2025, RedVDS-enabled activity has driven approximately $40 million in reported fraud losses in the United States alone. The service facilitated the compromise or fraudulent access of more than 191,000 organizations worldwide, with particularly severe impacts in the US, Canada, UK, France, and India. Notable victims include H2-Pharma (over $7.3 million lost) and the Gatehouse Dock Condominium Association in Florida (nearly $500,000 lost).
Investigation and Agencies Involved
Microsoft’s Digital Crimes Unit led the legal action, supported by law enforcement partners in Germany, the UK, and Europol. The operation involved seizing domains, identifying technical fingerprints of RedVDS infrastructure, and collaborating with global agencies to disrupt the broader network of servers and payment channels supporting RedVDS customers.
Arrests and Suspects
While the takedown focused on infrastructure, Microsoft is working to identify the individuals behind RedVDS, tracked as Storm-2470 and associated threat actors. The disruption marks the 35th civil action by Microsoft’s Digital Crimes Unit and the first coordinated legal action across both the US and UK targeting a cybercrime marketplace.
Broader Implications and Trends
The RedVDS case exemplifies the rise of cybercrime-as-a-service, where turnkey platforms enable even inexperienced criminals to launch sophisticated attacks at scale. The integration of AI tools for target identification, phishing, and impersonation further amplifies the threat. The takedown underscores the need for international cooperation, robust technical defenses, and public awareness to combat the evolving cybercrime ecosystem.