New Sophos research reveals how reused Windows images let bulletproof hosting providers spin up thousands of identical servers, obscuring ransomware attribution.