Police seize Virtualine bulletproof service tied to ransowmare, cybercrime

U.S. law enforcement has seized the primary domain of Virtualine, a bulletproof hosting service advertised on cybercrime forums for facilitating illegal activities.

The service also operated under the names Secury, Massgod, Spamhouse, Lanedo, and Omegatech, and promised to shield customers from legal complaints and requests from law enforcement and other authorities.

The U.S. Department of Justice (DOJ) confirmed that Virtualine marketed services that permitted “illegal/black hat activities” ranging from phishing, spamming, and carding to port scanning.

The FBI seized the primary domain of the service, virtualine[.net], following an investigation that involved Germany’s Polizei Hessen, the Netherlands’ Politie Midden-Nederland, the U.K.’s National Crime Agency, as well as private partners OverRIPE and Lumen.

Although Virtualine drew an apparent line at child content, authorities say that the operator knowingly hosted an online forum promoting child abuse material and ignored repeated notices from law enforcement, the National Center for Missing and Exploited Children (NCMEC), and a victim’s attorney.

Authorities allege that after legal pressure against the forum increased, Virtualine worked with the administrators to set up a new site.

"Virtualine hosts this new website to this day, and it has already received at least one abuse complaint about sexually explicit images of children found on that website," the DoJ said.

The administrator of the Virtualine rejected the allegation in an open letter to authorities published on a new website, virtualine[.]org, captured by cybersecurity company Silent Push.

The operator said that while claims about the service's illegal activities and customers "deserve a fair investigation," they regarded "sexual exploitation of children as a crime against humanity."

Cybercrime ecosystem

Virtualine also accepted direct Bitcoin payments from customers, helping cybercriminals launder proceeds stolen elsewhere.

Blockchain intelligence firm Chainalysis, which provided intelligence support to law enforcement, linked Virtualine’s payment addresses directly to ransomware operators, infostealer infrastructure, Russian-language cybercrime forums, illicit shops, scams, and phishing platforms.

“Virtualine accepted direct bitcoin payments through unhosted wallet addresses, allowing criminal customers to pay without flagging their funds through hosted exchange compliance programs,” Chainalysis notes.

“Virtualine then laundered those proceeds to conceal their origin,” the blockchain company added.

In a report published today, blockchain intelligence firm TRM said ransomware groups were responsible for 5% of Virtualine’s financial flows, while a Russian drug marketplace made up approximately 44%.

"A large sextortion scheme and a mixer were also major sources of funds," the company said.

TRM says that Virtualine also received payments from the StealC infostealer this year, with transactions indicating a constant financial relationship.

A press release from the Dutch police notes that dozens of physical servers were seized in Limburg, taking hundreds of virtual servers offline.

Politie also said its investigators recovered data from more than 3,000 Virtualine customers, and follow-up action against them is underway.

According to the authorities in the Netherlands, the illegal platform was facilitating cybercrime operations since at least 2022, including ransomware, botnets, infostealers, phishing, and distribution of child abuse material.

Although the bulletproof hosting provider remains partially online, researchers observed that its network prefixes currently have very low routing visibility, suggesting that much of its infrastructure may no longer be reachable.