Bulletproof Hosting: A Key Cybercrime Enabler?

Welcome back, or, if you haven’t seen my previous article introducing the concept of Bulletproof Hosting (BPHs), then welcome. Today we are diving deeper into the world of cybercrime, where BPHs play a starring role.

Cybercrime-as-a-Service

If you haven’t already heard of this, I’m going to introduce to you a concept called Cybercrime-as-a-service (CaaS). Imagine a marketplace, but instead of fruits and vegetables, the stalls are selling malware, ransomware, and botnets. This is the world of CaaS. This allows cybercriminals to specialise in one part of the criminal supply chain, making it easier for newcomers to jump in. The backbone of this criminal supply chain is BPH providers who provide the infrastructure for all of this to occur on. As evidenced by the 40 BPHs being advertised in 2019 on Russian Dark Web Forums XSS and Exploit.

How Bulletproof Hosting Supports Cybercrime

BPHs provide the online infrastructure that cybercriminals need to operate. It’s like giving them a secret lair where they can deploy ransomware, build botnet infrastructure, operate dark markets, and distribute malware. These services offer anonymity and unregulated platforms, ensuring cybercriminals can act with less fear of identification or having their platforms taken down. As flagged in my previous article, these services are often based in countries with lenient laws or weak enforcement of them, providing a safe haven for illicit activities. Some providers even boast about ignoring law enforcement-issued takedown requests and abuse complaints, allowing cybercriminals to operate unchecked for extended periods. This resilience ensures that illicit activities can continue even when detected by security researchers or law enforcement.

Common Services Offered by BPH Providers

So, what exactly do these BPH providers offer? Well, there are multiple categories of services. Operational infrastructure like virtual private servers, dedicated servers and shared hosting. Continuity includes Backup services and technical support. Defence mechanisms include DDoS protection and fast flux. Fast flux, if you don’t know, is a proxy network that rapidly rotates IP addresses, domains, and name servers, making it difficult for network protections to identify or block malicious attacks. Imagine a criminal constantly changing addresses every few minutes so they can’t be found — that’s fast flux for websites.

Advertising and Payment Methods

BPH providers tend to advertise their services on both clear and dark web forums and tend to accept payment in cryptocurrency. Clients can sign up anonymously using fake names, or no identification at all. This anonymity makes it incredibly challenging for law enforcement to track down the individuals behind these operations.

Examples of Bulletproof Hosting Providers

Let’s talk about a couple of well-known BPH providers. One is Perfect Quality Hosting, or PQ Hosting. On the surface, it looks like a legitimate hosting provider offering “superservers” in the Netherlands. If you dig a little deeper, and you’ll find that this service is promoted on at least 14 different cybercrime forums. Infrastructure linked to PQ Hosting has ties to ransomware, malware variants, and cryptocurrency “mixers,” which help cybercriminals launder cryptocurrency. This service is growing rapidly, with new data centres popping up, indicating that the actor will likely further develop its capabilities, balancing legitimate hosting business while serving the underground community.

Another notable example is Proton66, a Russian Bulletproof Hosting provider. DomainTools recently flagged a phony website named cybersecureprotect[.]com hosted on Proton66. This site masqueraded as an antivirus service, but an operational security failure exposed its malicious infrastructure, revealing the malicious payloads staged on the server. This led to the identification of an emerging actor named Coquettte, who is potentially tied to the broader hacking group called Horrid, who was using Proton66 to distribute malware under the guise of legitimate antivirus tools.

Wrapping Up

In conclusion, BPH services are a crucial backbone of the cybercrime ecosystem. By providing anonymity, resilience, and robust infrastructure, they enable cybercriminals to operate with relative impunity. Stay tuned, as I delve deeper into the shadowy world of Bulletproof Hosting and the major players currently supporting crime.