In a nutshell: Crimeware-as-a-service is turning digital crime into a commoditized market, giving nearly anyone access to advanced tools for malicious purposes. Microsoft and law enforcement are pushing back with both technological defenses and legal action – moves that could have far-reaching consequences.
Microsoft recently announced a civil lawsuit against RedVDS, a prominent cybercrime service responsible for stealing millions of dollars from high-profile targets. RedVDS exemplifies the growing cybercrime-as-a-service (CaaS) problem, using a subscription-based model to deploy malicious computing resources and coordinate large-scale phishing campaigns.
Microsoft's Digital Crimes Unit collaborated with authorities in the United Kingdom, Germany, and Europol to seize key components of the RedVDS group's malicious infrastructure. The service has been active since at least March 2025 and enabled fraudulent activities that resulted in at least $40 million in losses in the United States alone.
RedVDS clients hit Alabama pharmaceutical company H2-Pharma for $7.3 million. The company said it earmarked those funds to support cancer treatments and other critical healthcare initiatives. Another victim, the Florida-based Gatehouse Dock Condominium Association (GDCA), lost around $500,000 to hackers using the group's resources. Residents had contributed the money to fund essential property repairs.
Criminals or script-kiddies could pay as little as $24 per month to access RedVDS's rich feature set, which included "disposable" virtual machines and tools capable of sending millions of phishing emails per day. Microsoft said that most of these malicious messages were blocked or flagged as cyberattacks, though a small number were able to reach their targets.
RedVDS provided computing resources used to compromise or unlawfully access nearly 200,000 organizations worldwide, most targeted by a fraud scheme known as business email compromise (BEC). Under the scheme, attackers gained unauthorized access to sensitive email accounts, allowing them to monitor ongoing conversations.
After a successful BEC attack, criminals would exploit an upcoming payment operation to impersonate a trusted party in the payment chain. RedVDS tools would route the funds to a malicious recipient instead of the intended bank account. Attackers used complex BEC schemes in the H2-Pharma and GDCA heists.
Microsoft emphasized how monetary fraud not only significantly impacts organizations but also affects individuals.
"For the individual, fraud has lasting effects that extend beyond financial loss to emotional wellbeing, health, relationships, and long-term stability," the tech giant said in its report.
Thanks to a coordinated international effort with law enforcement agencies, Redmond helped seize two domains used by RedVDS to host its marketplace and customer portals. The company plans to continue working with partners to sustain the enforcement operation and ultimately identify the individuals behind the malicious CaaS business.