Taking down criminal content sometimes means removing evidence that would prove hosting providers’ culpability

How a Kremlin-Tied Hosting Network Became the Backbone of International Cybercrime—and Why the U.S. Treasury Just Pulled the Plug

CODA gegen die Szene: Die japanische Anti-Piracy-Vereinigung greift hart durch. Anime-Streaming auf illegalen Plattformen wird riskanter. Der Artikel <a href="https://tarnkappe.info/artikel/rechtssachen/coda-gegen-die-szene-der-globale-krieg-gegen-anime-piraterie-316800.html">CODA gegen die Szene: Der globale Krieg gegen Anime-Piraterie</a> erschien zuerst auf <a href="https://tarnkappe.info">TARNKAPPE.INFO</a>

The US Justice Department unsealed an indictment against Aleksandr Alexandrovich Volosovik, Kirill Andreevich Zatolokin, and Yulia Pankova for allegedly operating ML.Cloud and Media Land, two bulletproof hosting services used by cybercriminals. The services were reportedly used for phishing, DDoS attacks, brute-force attacks, ransomware, and hosting cybercrime forums, with victims across 21...

Qué es el Bulletproof Hosting, cómo funciona su infraestructura y qué casos reales terminaron con condenas y servidores incautados.

  The evolution of cybercrime has led to infrastructure becoming less of a matter of ownership and more of a convenience issue. As opposed to investing time and resources in the construction and maintenance of dedicated command-and-control servers, ransomware operators are increasingly renting inexpensive virtual machines that blend seamlessly into legitimate hosting environments as a practical alternative.  As a result of this shift, attackers have enhanced their operational strategy by embedding their activities within widely used infrastructure, thereby gaining scalability, plausible deniability, and operational resilience.  In the event of the disruption of one node, dozens, sometimes hundreds, of nearly identical systems continue to run in parallel, ensuring that campaigns continue uninterrupted.  Sophos investigators, following this operational shift, identified a series of recent WantToCry ransomware attacks that were triggered by virtual machines that were provisioned through infrastructure managed by ISPsystem, a legitimate provider of virtualization and hosting control panels.  In forensic analysis of several incidents, researchers observed an underlying pattern: attackers controlled Windows virtual machines whose hostnames were the same.  As the systems appeared to have been deployed using default Windows templates from ISPsystem's VMmanager platform, it can be deduced that threat actors were utilizing standardized rather than customized builds.  Based on the correlation between telemetry and sinkhole data, it was found that the same hostname conventions were shared among infrastructures associated with multiple ransomware operations, including LockBit, Qilin, Conti, BlackCat, also known as ALPHV, and Ursnif, a banking trojan. In addition to ransomware, infrastructure overlaps with campaigns distributing information-stealing malware, such as RedLine and Lumma.  A high frequency of identical system identifiers between geographically dispersed incidents indicates the reuse of templates rather than isolated deployments within the virtual environment. ISPsystem's VMmanager platform facilitates rapid provisioning and lifecycle management of Windows and Linux virtual machines, making it widely used by hosting providers.  According to Sophos, the default Windows images in VMmanager use the same hostname and certain system identifiers upon deployment. Within benign environments, such uniformity may go unnoticed, while within hostile environments, it becomes a disguise. The bulletproof hosting operators exploit this architectural feature by enabling their clients to instantiate virtual machines en masse, which allow malicious command-and-control and payload delivery servers to be embedded within pools of otherwise legitimate systems. The result is infrastructure dilution: malicious nodes become statistically indistinguishable from thousands of benign peers, resulting in a challenge in attribution efforts and a reduced likelihood of swift remediation.  Several of these virtual machines had a concentration that was not evenly distributed. A significant proportion were traced to a small number of hosting providers with history of abuse complaints or regulatory scrutiny, such as Stark Industries Solutions Ltd., Zomro B.V., First Server Limited, Partner Hosting LTD, and JSC IOT.  Moreover, researchers identified MasterRDP as a recurrent element in the ecosystem, providing VPS and RDP services that are resistant to legal intervention while maintaining direct control over physical infrastructure. The Sophos analysis revealed that over 95 percent of ISPsystem virtual machines with internet-facing hostnames came from four default Windows hostnames generated by ISPsystems.  There was a correlation between each of these identifiers and detected cybercriminal activity, strengthening the assertion that templated infrastructure is being systematically repurposed to sustain large-scale ransomware and malware operations.  After expanding their dataset, the researchers identified over 7,000 internet-facing servers sharing one autogenerated hostname, which were spread across Russian, multiple European countries, the United States, as well as Iran and Israel. According to Sophos' Counter Threat Unit, two hostnames in particular recurred consistently both in the WantToCry investigation and in the reporting of general threat intelligence.  The identifiers identified in this report were not restricted to one particular campaign. Observations from third parties and telemetry correlated them with operations involving LockBit, Qilin, and BlackCat, as well as NetSupport RAT deployments.  Among the uses of these systems have been host-and-control servers for ransomware, secondary malware payloads distribution, phishing campaigns, botnet management, and staging exfiltrated data for monetization. This pattern of reusable infrastructure templates is likely to have persisted for a minimum of five years, according to investigators. Ironically, despite the strategy reducing operational costs and speeding up deployment for threat actors, it introduces a measurable signature. Defenders can benefit from the widespread reuse of static hostnames across thousands of ISPsystem-provided virtual machines by clustering these hosts into clusters that can be useful for attribution and campaign tracking.  Virtual machines were identified by a narrow group of hosting providers, including several companies which have been repeatedly linked to cybercriminal or state-sponsored activity. According to Sophos, some legitimate traffic may originate from these environments, however additional intelligence identifies Stark Industries Solutions Ltd. as the most prominent provider. Cybercriminal ecosystems and Russian state-sponsored operations are linked to First Server Limited and First Server Limited. Regulatory scrutiny has followed the establishment of Stark Industries in early 2022, shortly prior to the Russian invasion of Ukraine. Several threat groups have been observed to leverage Stark Industries' infrastructure since that time.  Stark Industries Solutions and its operators were imposed restrictive measures by the European Council in May of last year for their involvement in destabilizing activities by Russian state-affiliated actors, based on their role in facilitating such activities. Due to its apparent connection with Doppelganger, a Russian disinformation campaign sanctioned by the UK government in October 2024, First Server Limited has also received attention. According to our assessment, MasterRDP is among a number of bulletproof hosting providers that lease ISPsystem managed virtual machines on abuse-tolerant infrastructure to customers who conduct ransomware and malware operations.  ISPsystem's VMmanager remains a viable and widely used virtualization management platform in the global hosting industry, according to researchers. The software itself is not inherently malicious; however, it is attractive to threat actors seeking scalable infrastructure due to its low cost, ease of onboarding, and rapid deployment capabilities.  A combination of its widespread user base with its extensive ubiquity allows malicious deployments to maintain operational cover, enabling ransomware and malware campaigns to persist among thousands of routine, compliant virtual machine instances. As a result of these findings, the hosting ecosystem is facing a broader structural challenge.  Because virtualization platforms reduce infrastructure deployment barriers, security responsibility is increasingly shifting away from providers, resellers, and enterprise customers to ensure that template hygiene is implemented effectively, unique system identifiers are enforced, and anomalous clustering patterns are monitored. As a result of proactive hostname randomization, stronger customer vetting, transparency in abuse response, and cross-industry intelligence sharing, threat actors may be less likely to use templated infrastructure.  As demonstrated by these consistent artifacts exposed in the campaign, even commoditized infrastructure leaves discernible patterns behind. It will not be sufficient to dismantle individual malicious nodes. Instead, it will be necessary to address the systemic weaknesses that allow legitimate technology to be silently adapted for large-scale, persistent cybercrime operations.

  Authorities in the United States, the United Kingdom, and Australia have jointly imposed sanctions on a Russian bulletproof hosting provider accused of giving safe and long-term technical support to ransomware operators and other criminal groups. Officials say the newly sanctioned entities have played a central role in keeping several high-impact cybercrime operations online. A bulletproof hosting service is a type of internet infrastructure provider that knowingly allows harmful activity on its servers. These companies rent out digital space and refuse to take down malicious websites, even when they receive complaints from victims or requests from law enforcement. Such services help threat actors conduct phishing campaigns, distribute malware, run command and control systems for their attacks, and host illegal content without fear of quick removal. This resistance to oversight makes it harder for investigators to disrupt cybercriminal networks. Media Land and its linked companies named as key targets The United States Treasury’s Office of Foreign Assets Control announced that Media Land, a Russia-based provider, has been added to the sanctions list along with three related firms: Media Land Technology, Data Center Kirishi, and ML Cloud. According to officials, Media Land’s infrastructure has been connected to well-known ransomware groups. It has also been tied to distributed denial-of-service attacks that targeted American companies, including systems categorized as critical infrastructure such as parts of the telecommunications sector. Officials name individuals connected to the operation Sanctions also extend to three people associated with Media Land. Aleksandr Volosovik has been identified as someone who promoted the company’s services on underground cybercriminal forums under the username Yalishanda. Another individual, Kirill Zatolokin, is accused of handling customer payments. A third person, Yulia Pankova, is said to have assisted with legal matters and financial management. The United Kingdom additionally stated that Volosovik has interacted with multiple cybercrime groups in the past. Other companies involved in supporting the infrastructure The sanctions package further includes Aeza Group LLC, another bulletproof hosting operator that had already been sanctioned earlier this year. Authorities say Aeza attempted to continue operating by using a UK-based company named Hypercore Ltd as a front. Additional entities in Serbia and Uzbekistan that provided technical assistance to the network have also been designated. Government agencies issue defensive guidance Along with the sanctions, cybersecurity agencies across the Five Eyes alliance released technical recommendations to help defenders identify and block activity linked to bulletproof hosting services. They suggest creating high-confidence lists of harmful internet resources based on verified threat intelligence, performing continuous monitoring of network traffic, and applying filtering rules at network boundaries while examining how those rules might affect legitimate users. The guidance also encourages service providers to maintain stronger onboarding checks for new customers since criminal operators often hide behind temporary email accounts or phone numbers. Implications of the sanctions All assets connected to the named individuals and companies within the United States, the United Kingdom, and Australia will now be frozen. Any organisation or person that continues to conduct transactions with them may face secondary sanctions or other enforcement actions. This step builds on earlier actions taken in February, when the three nations sanctioned ZServers, another Russian hosting operation, while Dutch authorities seized more than one hundred of its servers. The coordinated announcement signals a growing international effort to dismantle the online infrastructure that ransomware groups depend on. It also reinforces the need for organisations to maintain strong cybersecurity practices, rely on reputable service providers, and monitor threat intelligence to reduce exposure to criminal activity.

The name of one hosting provider is coming up again and again with connections to Russian hacktivists, cyber attacks attributed to elements…

Die niederländische Polizei hat den Bulletproof-Hosting-Anbieter ZServers/XHost"zerschlagen. 127 Server wurden beschlagnahmt. Der Artikel <a href="https://tarnkappe.info/artikel/szene/dark-commerce/bulletproof-hosting-anbieter-hochgenommen-zservers-xhost-zerschlagen-310237.html">Bulletproof-Hosting-Anbieter hochgenommen: ZServers/XHost zerschlagen</a> erschien zuerst auf <a href="https://tarnkappe.info">TARNKAPPE.INFO</a>

At a glance

Silent Push developed a new Bulletproof Hosting white paper to illustrate the current state of the BPH practice and allure to threat actors.

Join us on July 22 for an exclusive webinar where our analysts will reveal new insights from our latest report, exposing the hidden hosts behind today’s most persistent cyber threats.