GSE says Google suspended RedVDS-linked accounts, but did not lead the January server seizure

Google suspended accounts linked to the RedVDS cybercrime service after Microsoft shared threat indicators through the Global Signal Exchange, according to a GSE case study published on 14 July 2026. That cross-platform action extended an earlier disruption, but it was not a new joint seizure of the marketplace and its servers.

The distinction matters because a TechRadar report published on 21 September presented the operation as a Microsoft and Google takedown. The principal infrastructure action had occurred more than eight months earlier, on 13 and 14 January. Google’s documented role involved identifying and suspending associated accounts, rather than leading the civil domain action or physical server seizures.

Different organisations played different roles

German authorities said they seized RedVDS infrastructure on 13 January and shut down the platform. The operation took nearly 70 servers hosting its central service and more than 650 virtual servers. The notice described RedVDS as having more than 13,000 users and providing virtual desktops designed to enable largely anonymous cybercrime.

Microsoft announced the next day that coordinated civil action in the United States and United Kingdom, alongside German and Europol cooperation, had taken the marketplace and key infrastructure offline. Its published case notice says it obtained a temporary restraining order concerning relevant domains through a case in the Southern District of Florida.

The public US case names John Does 1 to 7, rather than identified individuals. Microsoft tracks the suspected operator or developer cluster under the vendor designation Storm-2470, but that label is not a public identification of named people and does not establish that the unnamed defendants have been convicted.

GSE’s July account added another part of the operation. It said Microsoft supplied RedVDS indicators through the exchange, allowing Google to identify and suspend numerous accounts associated with business email compromise. GSE did not publish an exact number or breakdown of those Google accounts, and no independent audit of the suspensions is public.

On GSE’s account, Google’s suspensions formed part of the broader disruption, even though Google was not responsible for Microsoft’s civil case or the German seizure. GSE also said continued Microsoft action had reduced active RedVDS servers by more than 95 per cent by February. That is an attributed estimate, not evidence that every part of the service was eliminated.

A paid service using unlicensed Windows software

RedVDS was a cybercrime infrastructure service, not a Windows vulnerability. According to Microsoft, it charged from US$24 a month for disposable Windows virtual servers that gave customers administrator control. Microsoft described the Windows software as unlicensed. Referring to it as free software would therefore obscure two points: access to RedVDS was paid, and the software licensing was not legitimate.

The service’s design made virtual infrastructure inexpensive and replaceable. Microsoft said RedVDS repeatedly cloned a Windows Server 2022 Evaluation image without changing the computer ID. That shortcut helped the operation reproduce virtual machines at scale, but also created a common technical fingerprint that defenders could use to connect otherwise dispersed activity.

Microsoft has not published all of its detection logic, and the repeated identifier should not be treated as the sole reason the operation succeeded. The disruption combined technical investigation, civil litigation, law-enforcement seizures and enforcement by another platform after indicators were shared.

US$66 million referred to losses, not value

The description of RedVDS as a US$66 million marketplace is also misleading. GSE attributed more than US$66 million in reported US fraud losses since March 2025 to activity linked with the service. The figure was not presented as RedVDS revenue, transaction volume or valuation.

The estimate has changed as organisations have published updates. Microsoft’s January announcement put directly observed US losses at roughly US$40 million. The July GSE case study reported more than US$66 million, while Microsoft’s current disruption overview rounds the figure to approximately US$70 million for activity since March 2025.

Those numbers may represent successive updates rather than a contradiction, but the sources do not publish matching evidence cutoffs or a complete loss-attribution methodology. They should therefore be dated and attributed rather than combined into a single final total.

GSE also said more than 191,000 Microsoft email accounts across more than 130,000 organisations were compromised or fraudulently accessed between September and December 2025. The distinction between accounts and organisations is important because the two figures measure different things.

Microsoft has identified specific business email compromise cases among the losses. It said H2-Pharma lost more than US$7.3 million and the Gatehouse Dock Condominium Association lost nearly US$500,000. Both organisations are co-plaintiffs in the US civil action.

Why the case matters in Australia

Microsoft said RedVDS-enabled activity affected more than 9,000 customers in the real estate sector, with particularly severe impact in Australia and Canada. It did not publish an Australia-specific victim count or loss total, but the finding gives Australian organisations a direct reason to review controls around email accounts, invoices and payment changes.

Defensive guidance for business email compromise remains focused on accounts and financial processes, not a RedVDS software patch. Organisations should verify changes to payment or bank details through a second channel, using contact information already known to them. Multifactor authentication should be enabled on business email and other important accounts.

Staff should also examine sender addresses and domains for subtle spelling changes, particularly when a message creates urgency or pressure around a payment. Keeping software current remains a useful baseline, while suspected fraud should be reported to the relevant provider and law-enforcement body.

The RedVDS operation shows why infrastructure seizures and platform enforcement should be understood as complementary measures. The January action took central systems and domains offline; subsequent indicator sharing reportedly helped Google act against connected accounts. What remains unresolved is how many accounts Google suspended, how the changing loss estimates were calculated and whether RedVDS-linked infrastructure has materially re-emerged.

Distinguishing infrastructure action from account enforcement becomes clearer when networks, services and access are viewed as connected layers. Work through networking and cybersecurity fundamentals in The Hack Academy’s online cybersecurity training programme at your own pace, supported by theory and practical exercises.