US Charges Russian Bulletproof Web Hosts Over Cyberattacks That Generated $62M in Victim Losses
The US Department of Justice has unsealed a 2024 indictment charging three Russian nationals and two web hosting companies with operating so-called "bulletproof" hosting services—a term used for infrastructure designed to resist law enforcement takedowns and provide anonymity for malicious actors.
The indictment alleges that the accused operated web hosting services specifically marketed to cybercriminals, enabling threat actors to launch malware attacks, phishing campaigns, and other cyberattacks while evading detection. These services are known in the criminal underground as "bulletproof" because they ignore abuse complaints and resist legal requests to take down malicious content.
The three Russian nationals and two companies face charges related to aiding and abetting hackers, as well as profiting from cybercrime proceeds. The alleged criminal activity reportedly caused approximately $62 million in losses to victims worldwide.
Bulletproof hosting services have long been a critical enabler of cybercrime ecosystems, providing the technical infrastructure that allows threat actors to operate anonymously and maintain persistent campaigns. Law enforcement agencies have increasingly targeted these intermediaries as a strategy to disrupt cybercriminal operations at scale.