Loading story…
The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the FBI, NSA, DoD Cyber Crime Center, and international partners, has released comprehensive guidance aimed at disrupting bulletproof hosting providers that enable cybercriminal operations. This new publication, informed by industry research, outlines the persistent threat posed by bulletproof hosting infrastructure, which is often used to facilitate ransomware and other cyberattacks by providing resilient, difficult-to-take-down services to malicious actors. The guidance emphasizes the need for proactive measures by Internet Service Providers (ISPs) and network defenders, including curating high-confidence lists of malicious resources, applying targeted filtering and blocking, and increasing visibility into hosting infrastructure that repeatedly supports criminal activity.
The joint effort reflects a growing recognition of the role bulletproof hosting plays in enabling large-scale cybercrime, particularly ransomware campaigns targeting critical sectors. The guidance, developed through the Joint Ransomware Task Force, encourages global cooperation and the adoption of best practices to limit the operational freedom of bulletproof hosting providers and reduce the overall risk to critical infrastructure. By uniting government agencies and industry partners, the initiative aims to make it significantly harder for threat actors to leverage these services for persistent and resilient attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
CISA, the FBI, and the NSA jointly released a new guide focused on disrupting and defending against bulletproof hosting ecosystems used by cybercriminals. The references indicate this as the central disclosed development and do not provide an earlier dated event beyond the publication of the guidance.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
International cybersecurity agencies have intensified efforts to dismantle bulletproof hosting providers (BPH), which supply resilient internet infrastructure to cybercriminals and ransomware groups. Authorities from the U.S., U.K., Australia, Canada, the Netherlands, and New Zealand have issued joint advisories and sanctions targeting BPH services that enable malware delivery, phishing, and illicit content hosting by ignoring abuse reports and law enforcement takedowns. The U.S. Office of Foreign Assets Control (OFAC) has sanctioned entities such as Media Land and its affiliates, which are linked to major ransomware groups including LockBit, BlackSuit, and Play. These coordinated actions aim to degrade the operational capabilities of cybercriminals by disrupting the infrastructure that underpins their activities. Guidance has been released to help internet service providers (ISPs) and network defenders identify and block malicious infrastructure associated with BPH services. The crackdown is part of a broader strategy to protect critical infrastructure, financial institutions, and other high-value targets from persistent cyber threats. The move underscores the growing recognition that disrupting the technical enablers of cybercrime is essential to reducing the global impact of ransomware, data breaches, and other forms of cyber-enabled fraud. Authorities emphasize the need for industry collaboration to effectively mitigate the risks posed by bulletproof hosting and to enhance the resilience of the digital ecosystem.
Jun 29, 2026
The United States, United Kingdom, and Australia have jointly imposed sanctions on Media Land, a Russian bulletproof hosting provider, along with its leadership and affiliated companies, for facilitating ransomware operations and other cybercrimes. Media Land has been identified as a critical infrastructure provider for major ransomware groups such as LockBit, BlackSuit, and Play, offering services that enable these actors to evade law enforcement and conduct attacks against businesses and critical infrastructure in the U.S. and allied countries. The sanctions also extend to related entities, including Hypercore Ltd. and Aeza Group, and target individuals responsible for managing and supporting these operations. Authorities highlighted that Media Land's infrastructure was used not only for ransomware but also for distributed denial-of-service (DDoS) attacks and other illicit activities, with its executives actively coordinating with cybercriminals and providing operational support. In parallel with the sanctions, U.S. and international cyber agencies released new guidance to help internet service providers and network defenders mitigate risks from bulletproof hosting providers. The guidance recommends measures such as curating malicious resource lists, implementing network filters, monitoring traffic for anomalies, and sharing threat intelligence to disrupt the infrastructure that enables ransomware and other cyber threats. These coordinated actions underscore a broader effort by Western governments to dismantle the technical and financial networks that sustain global cybercrime operations, particularly those emanating from Russia and its network of bulletproof hosting services.
Aug 7, 2026
Threat intelligence reporting identified bulletproof hosting as a key enabler of long-running cybercrime campaigns, with providers such as **Void Griffon** offering dedicated servers, VPS/VDS instances, domain registration, API access, and **FastFlux** services that kept malicious infrastructure online for years. Researchers found that multiple malware families and phishing operations relied on these resilient services, while broader analysis showed criminals also combining compromised servers, cloud assets, botnets, proxies, VPNs, Tor, dynamic DNS, and decentralized DNS to support command-and-control, spam, fraud, data exfiltration, and ransomware deployment. Additional investigations tied shared hosting patterns to coordinated malicious infrastructure used for **Magecart**, **IcedID**, **Qakbot**, **Ursnif**, and brand-spoofing phishing campaigns, with synchronized IP rotation and recurring registrar and nameserver choices suggesting infrastructure-as-a-service for cybercrime. Intrinsec later linked a reused SSH fingerprint across about **138 servers** to **ShadowSyndicate**, connecting that infrastructure to **LockBit**, **Cl0p/TrueBot**, **RansomHub**, **Cicada3301**, **Atomic macOS Stealer**, and **RustDoor**, and assessed that the group likely depended on Russian-operated bulletproof hosting designed to resist takedowns while continuing to scan for vulnerabilities and deliver payloads.
Aug 15, 2026