Microsoft and Authorities Dismatles BEC Attack Chain Powered by RedVDS Fraud Engine

A collaborative effort between Microsoft and international law enforcement agencies has effectively dismantled a business email compromise (BEC) attack chain that was facilitated by the RedVDS fraud engine.

RedVDS functioned as a low-cost cybercrime subscription platform, offering criminals access to temporary virtual machines that mimicked standard Windows systems on the internet. These resources were utilized by threat actors to conduct extensive phishing campaigns, host fraudulent portals, and orchestrate payment diversion schemes targeting industries such as finance, real estate, healthcare, and manufacturing.

Technical Execution of the Attack Chain

The attack chain involved the use of RedVDS virtual machines to send targeted phishing emails, which harvested credentials from platforms like Microsoft 365. Once access to mailboxes was obtained, attackers monitored genuine communications between vendors, clients, and internal teams, waiting for opportunities to alter payment instructions. At opportune moments, they inserted fake responses with modified banking details, redirecting large sums to accounts they controlled.

Microsoft analysts identified that RedVDS enhanced these fraudulent activities by combining high-volume infrastructure with AI tools capable of generating realistic email content, voice messages, and even deepfake videos. On peak days, over 2,600 RedVDS virtual machines distributed approximately one million phishing emails to Microsoft customers, leading to compromised access in over 191,000 organizations globally.

The coordinated takedown involved seizing RedVDS domains, disrupting payment channels, and removing a foundational element of this fraudulent ecosystem. Investigations revealed RedVDS's involvement in real estate payment diversions, where compromised mailboxes were used to send fraudulent closing instructions. In several instances, victims transferred their savings to mule accounts shortly after receiving spoofed messages.

Technically, the BEC chain adhered to a repeatable process. Threat actors either created or rented RedVDS instances, deployed basic tools, and accessed live mailboxes using stolen credentials. A common approach included scripted login checks and inbox scans:

for user in target_users: if login(user.email, user.passwd, proxy=redvds_host): for msg in inbox.search("invoice OR payment OR wire"): if "upcoming" in msg.body.lower(): mark_as_watchlist(msg.thread_id)

Once a payment thread was identified, the attacker crafted a fake reply from the compromised account, often reusing real signatures and footers:

fake_reply = build_reply(original_thread, body=new_bank_instructions, from_account=compromised_mailbox) send(fake_reply, via=redvds_host)

Microsoft researchers noted that this structured approach, combined with disposable RedVDS nodes, made the fraud both scalable and difficult to trace. The recent operation highlights the importance of targeting shared criminal infrastructures to effectively reduce the global BEC attack surface.

Based on reporting by Cyber Security News.