Bulletproof Hosting: Conti Ransomware and Stark Industries

Welcome back to my ongoing exploration of the shadowy world of bulletproof hosting (BPH). If you’re new, you can read this as a standalone, but I recommend checking out my previous articles on what is bulletproof hosting, how it enables cybercrime and one key BPH Proton66. Today, we’re diving into the history of a notorious ransomware group, Conti, and one of the BPHs they used to support their activities.

The Rise and Fall of Conti

Conti was a ransomware-as-a-service (RaaS) group that disbanded in 2022, but before then, they were one of the most prolific cybercrime organisations. Believed to be controlled by a Russian cybercrime group called WizardSpider, Conti made headlines in with their sophisticated double extortion techniques. Their modus operandi was not just to encrypt data and demand ransom, but also to exfiltrate valuable data and threaten to release it if their demands weren’t met. This added layer of extortion put immense pressure on their victims, leading to more payouts.

One of Conti’s most high-profile attacks was on the Irish Health Service, causing massive disruptions. Not only were services brought to a halt, but database servers (SQL) and over 700GB of personally identifiable information (PII) were exfiltrated by the threat actors.

The RaaS approach allowed Conti to operate like a franchise, with vetted affiliates conducting attacks and earning a hefty sum of the ransom, while the ransomware authors received a percentage of the gains. This scalable model increased the rate and volume of attacks as the number of affiliates grew.

The Role of Bulletproof Hosting

BPHs are a crucial enabler for cybercriminal activities, and Conti ransomware was no exception. SophosLabs, while investigating several WantToCry ransomware incidents, identified several hostnames, including WIN-LIVFRVQFMKO, which were used in multiple cybercrime incidents including Conti ransomware. One of the hosting providers linked to this hostname was Stark Industries Solutions Ltd.

While there might be some legitimate activity hosted by BPHs with these hostnames, additional data links Stark Industries Solutions Ltd, one such BPH, to cybercriminal and Russian state-sponsored operations.

The Art of Evasion

Stark Industries was a master at evasion tactics. They demonstrated one of the key features of BPHs in 2025 when the European Union attempted to place sanctions on it for enabling Russian state-sponsored cyber operations. Before the EU could act, the company had already transferred its Autonomous System AS44477 to a new RIPE organisation. Russian infrastructure was transferred to Moscow-based UFO Hosting LLC, setting the stage for a full rebranding to ‘THE.Hosting’ under the Dutch company WorkTitans B.V. This strategic shifting of autonomous systems, IP blocks, and corporate entities made months of regulatory efforts largely irrelevant as Stark Industries could no longer be held accountable for their actions. This kind of agility is a hallmark of BPHs, making it incredibly challenging for authorities to pin them down.

The Aftermath

The Conti group may have disbanded, but the methods they employed and the infrastructure they relied on remain prevalent in the cyber ecosystem and are still a significant concern. BPHs like Stark Industries continue to operate, providing safe havens for cybercriminals to launch their attacks. The cat-and-mouse game between law enforcement and these providers is ongoing, with each side continuously evolving their tactics.

Staying Informed

Understanding the intricacies of bulletproof hosting and the role it plays in enabling cybercrime is crucial for anyone interested in cybersecurity as BPHs are a critical threat actor enabler and targeting the enablers can have a real impact on preventing cybercrime. By staying informed about these issues, we can better appreciate the challenges faced by those working to make the digital world a safer place.

If you found this article interesting let me know and stay tuned for more deep dives into the world of cybercrime and the hidden enablers that make it possible. Until next time, stay safe online!

References

[embed]The Stark Industries Shell Game - When Bulletproof Hosting Proves Bulletproof EU sanctions hit Stark Industries in May 2025. GreyNoise data shows how the group quietly rebranded to THE.Hosting and…www.greynoise.io

[embed]The Affiliate's Cookbook - A Firsthand Peek into the Operations and Tradecraft of Conti FortiGuard Labs takes a detailed look into recently leaked documentation provided to criminal affiliates of…www.fortinet.com

[embed]Malicious use of virtual machine infrastructure Bulletproof hosting providers are abusing the legitimate ISPsystem infrastructure to supply virtual machines to…www.sophos.com