Loading story…
International cybersecurity agencies have intensified efforts to dismantle bulletproof hosting providers (BPH), which supply resilient internet infrastructure to cybercriminals and ransomware groups. Authorities from the U.S., U.K., Australia, Canada, the Netherlands, and New Zealand have issued joint advisories and sanctions targeting BPH services that enable malware delivery, phishing, and illicit content hosting by ignoring abuse reports and law enforcement takedowns. The U.S. Office of Foreign Assets Control (OFAC) has sanctioned entities such as Media Land and its affiliates, which are linked to major ransomware groups including LockBit, BlackSuit, and Play. These coordinated actions aim to degrade the operational capabilities of cybercriminals by disrupting the infrastructure that underpins their activities.
Guidance has been released to help internet service providers (ISPs) and network defenders identify and block malicious infrastructure associated with BPH services. The crackdown is part of a broader strategy to protect critical infrastructure, financial institutions, and other high-value targets from persistent cyber threats. The move underscores the growing recognition that disrupting the technical enablers of cybercrime is essential to reducing the global impact of ransomware, data breaches, and other forms of cyber-enabled fraud. Authorities emphasize the need for industry collaboration to effectively mitigate the risks posed by bulletproof hosting and to enhance the resilience of the digital ecosystem.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Weekly cybersecurity coverage reported notable malware-related findings or trends as part of the period's key developments. The provided references do not include enough detail to identify a more precise event date or a distinct malware incident.
New cybersecurity reporting highlighted CIS Benchmarks as a notable development or best-practice resource during the week covered by the references. The available content does not specify a separate underlying event date beyond the publication timeframe.
Global law enforcement or government agencies took action against criminal 'bulletproof' hosting providers, a development highlighted in cybersecurity roundup coverage. The references do not provide a more specific date for the operation beyond the publication window.
The Cloud Security Alliance unveiled new guidance for securing agentic AI systems, including an agentic AI red-team framework and a risk framework highlighted in weekly cybersecurity coverage. The release was reported in sources published on 2025-11-20 and 2025-11-21, but no more specific event date was provided.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the FBI, NSA, DoD Cyber Crime Center, and international partners, has released comprehensive guidance aimed at disrupting bulletproof hosting providers that enable cybercriminal operations. This new publication, informed by industry research, outlines the persistent threat posed by bulletproof hosting infrastructure, which is often used to facilitate ransomware and other cyberattacks by providing resilient, difficult-to-take-down services to malicious actors. The guidance emphasizes the need for proactive measures by Internet Service Providers (ISPs) and network defenders, including curating high-confidence lists of malicious resources, applying targeted filtering and blocking, and increasing visibility into hosting infrastructure that repeatedly supports criminal activity. The joint effort reflects a growing recognition of the role bulletproof hosting plays in enabling large-scale cybercrime, particularly ransomware campaigns targeting critical sectors. The guidance, developed through the Joint Ransomware Task Force, encourages global cooperation and the adoption of best practices to limit the operational freedom of bulletproof hosting providers and reduce the overall risk to critical infrastructure. By uniting government agencies and industry partners, the initiative aims to make it significantly harder for threat actors to leverage these services for persistent and resilient attacks.
Jul 12, 2026
The United States, United Kingdom, and Australia have jointly imposed sanctions on Media Land, a Russian bulletproof hosting provider, along with its leadership and affiliated companies, for facilitating ransomware operations and other cybercrimes. Media Land has been identified as a critical infrastructure provider for major ransomware groups such as LockBit, BlackSuit, and Play, offering services that enable these actors to evade law enforcement and conduct attacks against businesses and critical infrastructure in the U.S. and allied countries. The sanctions also extend to related entities, including Hypercore Ltd. and Aeza Group, and target individuals responsible for managing and supporting these operations. Authorities highlighted that Media Land's infrastructure was used not only for ransomware but also for distributed denial-of-service (DDoS) attacks and other illicit activities, with its executives actively coordinating with cybercriminals and providing operational support. In parallel with the sanctions, U.S. and international cyber agencies released new guidance to help internet service providers and network defenders mitigate risks from bulletproof hosting providers. The guidance recommends measures such as curating malicious resource lists, implementing network filters, monitoring traffic for anomalies, and sharing threat intelligence to disrupt the infrastructure that enables ransomware and other cyber threats. These coordinated actions underscore a broader effort by Western governments to dismantle the technical and financial networks that sustain global cybercrime operations, particularly those emanating from Russia and its network of bulletproof hosting services.
Aug 7, 2026
Dutch police have seized approximately 250 physical servers and thousands of virtual servers belonging to an unnamed bulletproof hosting provider operating out of The Hague and Zoetermeer. This hosting service, active since 2022, was used exclusively by cybercriminals and has been linked to over 80 cybercrime investigations both in the Netherlands and internationally. The provider advertised complete anonymity, did not enforce Know Your Customer (KYC) policies, and refused to cooperate with law enforcement, making it a popular choice for threat actors. The infrastructure supported a range of illicit activities, including ransomware operations, malware distribution, phishing campaigns, botnet control, and the hosting of child abuse content. The takedown blocks further criminal use of the service and enables forensic analysis of the seized servers to identify operators and clients. No arrests have been announced yet, but the operation is expected to provide valuable intelligence for ongoing and future investigations into cybercrime facilitated by bulletproof hosting services.
Jun 29, 2026