Loading story…
Threat intelligence reporting identified bulletproof hosting as a key enabler of long-running cybercrime campaigns, with providers such as Void Griffon offering dedicated servers, VPS/VDS instances, domain registration, API access, and FastFlux services that kept malicious infrastructure online for years. Researchers found that multiple malware families and phishing operations relied on these resilient services, while broader analysis showed criminals also combining compromised servers, cloud assets, botnets, proxies, VPNs, Tor, dynamic DNS, and decentralized DNS to support command-and-control, spam, fraud, data exfiltration, and ransomware deployment.
Additional investigations tied shared hosting patterns to coordinated malicious infrastructure used for Magecart, IcedID, Qakbot, Ursnif, and brand-spoofing phishing campaigns, with synchronized IP rotation and recurring registrar and nameserver choices suggesting infrastructure-as-a-service for cybercrime. Intrinsec later linked a reused SSH fingerprint across about 138 servers to ShadowSyndicate, connecting that infrastructure to LockBit, Cl0p/TrueBot, RansomHub, Cicada3301, Atomic macOS Stealer, and RustDoor, and assessed that the group likely depended on Russian-operated bulletproof hosting designed to resist takedowns while continuing to scan for vulnerabilities and deliver payloads.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
On July 31, 2025, Intrinsec published a report proposing a new heuristic for tracking ShadowSyndicate based on a reused SSH fingerprint seen across 138 servers. The report linked the infrastructure to multiple ransomware and malware ecosystems and assessed moderate confidence in ties to Russian-operated bulletproof hosting.
Intrinsec observed 128 malicious domains resolving to 81.19.135.228 between 2024-12-06 and 2025-03-31 in a DeepSeek-themed lure cluster distributing Atomic Stealer. The report described this as strong overlap between ShadowSyndicate infrastructure and Atomic macOS Stealer activity.
A malicious MSI sample associated with ShadowSyndicate-linked infrastructure was first submitted from Russia on 2024-09-18. The sample communicated with datasmetrics.com, attempted to download Loader_TM.dll, and was signed with a legitimate SCANDI LLC certificate.
Cicada3301 was first observed in June 2024 as a Rust-based ransomware operation. Intrinsec later identified at least one overlapping IP between Cicada3301 affiliate infrastructure and ShadowSyndicate-linked infrastructure.
In September 2023, Group-IB reported a ShadowSyndicate tradecraft pattern involving a reused SSH fingerprint. Intrinsec later used the same fingerprint as a heuristic to track roughly 138 linked servers.
Intrinsec described ShadowSyndicate as an intrusion set active since at least July 2022. The group was linked to multiple ransomware ecosystems and later assessed as relying on resilient bulletproof hosting infrastructure.
Trend Micro's assessment of Void Griffon was based on data collected from February 2017 to March 2022, covering the top malware families hosted there by number of hosting days. The research framed Void Griffon as a stable infrastructure provider supporting long-running cybercriminal operations.
Around March 8, 2021, nine more domains joined the Magecart-related IP rotation cycle. The expansion strengthened the assessment that multiple spoofing domains were operating on coordinated infrastructure.
Domains associated with IcedID and Qakbot malware delivery were registered between late February and mid-March 2021, mostly through Hosting Concepts and some through REG.RU. They used DNSPod name servers and overlapped with Magecart infrastructure on shared IPs.
During January through March 2021, the Magecart-linked domain cluster rotated through twenty IP addresses, many on Google-hosted infrastructure. Silent Push highlighted the synchronized movement as evidence of shared malicious infrastructure.
A cluster of Magecart-linked spoofing domains impersonating services such as Cloudflare, Google, jQuery, and Magento were registered at REG.RU. The domains were later assessed as part of infrastructure likely backed by a bulletproof hosting service.
Intrinsec found moderate overlap between ShadowSyndicate infrastructure and LockBit 3.0 infrastructure used in exploitation of Citrix Bleed, including about forty overlapping IP addresses. The report also noted Cobalt Strike beacons on ShadowSyndicate-linked IPs during the Citrix Bleed exploitation timeframe.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
intrinsec.com
Open sourcetrendmicro.com
Open sourcesilentpush.com
Open sourcedocuments.trendmicro.com
Open sourcedocuments.trendmicro.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos reported that some hosting environments are unintentionally (and in some cases deliberately) helping criminals **conceal ransomware and malware infrastructure** by repeatedly deploying **preconfigured Windows VM images** without changing default system identifiers such as hostnames. This results in large numbers of unrelated servers sharing the same computer name, which can make distinct threat operations appear connected and can cause older infrastructure to “disappear” and reappear under the same hostname but different IPs—complicating tracking, attribution, and takedown efforts. Sophos observed more than **7,000 servers** associated with ransomware activity sharing a single hostname, and noted that this pattern can provide cover for short-lived ransomware operations among legitimate systems. In investigations tied to recent **WantToCry** ransomware activity, Sophos found attackers abusing VMs provisioned via *ISPsystem*’s **VMmanager** (a legitimate virtualization management platform used by hosting providers) to host and deliver payloads at scale, with identical hostnames indicating reuse of default Windows templates. The same hostname patterns were also observed across infrastructure linked to multiple operations, including **LockBit**, **Qilin**, **Conti**, **ALPHV/BlackCat**, and malware campaigns involving **Ursnif**, **RedLine**, and **Lummar**. Sophos assessed that **bulletproof hosting providers** can exploit this design/operational weakness to blend malicious C2 and payload-delivery systems into large pools of innocuous VMs; cited providers associated with this activity included **Stark Industries Solutions Ltd.**, **Zomro B.V.**, **First Server Limited**, **Partner Hosting LTD**, and **JSC IOT**.
Jun 29, 2026
Dutch police have seized approximately 250 physical servers and thousands of virtual servers belonging to an unnamed bulletproof hosting provider operating out of The Hague and Zoetermeer. This hosting service, active since 2022, was used exclusively by cybercriminals and has been linked to over 80 cybercrime investigations both in the Netherlands and internationally. The provider advertised complete anonymity, did not enforce Know Your Customer (KYC) policies, and refused to cooperate with law enforcement, making it a popular choice for threat actors. The infrastructure supported a range of illicit activities, including ransomware operations, malware distribution, phishing campaigns, botnet control, and the hosting of child abuse content. The takedown blocks further criminal use of the service and enables forensic analysis of the seized servers to identify operators and clients. No arrests have been announced yet, but the operation is expected to provide valuable intelligence for ongoing and future investigations into cybercrime facilitated by bulletproof hosting services.
Jun 29, 2026
The Cybersecurity and Infrastructure Security Agency (CISA), in collaboration with the FBI, NSA, DoD Cyber Crime Center, and international partners, has released comprehensive guidance aimed at disrupting bulletproof hosting providers that enable cybercriminal operations. This new publication, informed by industry research, outlines the persistent threat posed by bulletproof hosting infrastructure, which is often used to facilitate ransomware and other cyberattacks by providing resilient, difficult-to-take-down services to malicious actors. The guidance emphasizes the need for proactive measures by Internet Service Providers (ISPs) and network defenders, including curating high-confidence lists of malicious resources, applying targeted filtering and blocking, and increasing visibility into hosting infrastructure that repeatedly supports criminal activity. The joint effort reflects a growing recognition of the role bulletproof hosting plays in enabling large-scale cybercrime, particularly ransomware campaigns targeting critical sectors. The guidance, developed through the Joint Ransomware Task Force, encourages global cooperation and the adoption of best practices to limit the operational freedom of bulletproof hosting providers and reduce the overall risk to critical infrastructure. By uniting government agencies and industry partners, the initiative aims to make it significantly harder for threat actors to leverage these services for persistent and resilient attacks.
Jul 12, 2026