Researchers Map Multi-Network Cybercrime Infrastructure
Summary: Security experts knocked Eastern European ISP Troyak offline on March 9, 2010, but the provider bounced between legitimate ISPs for seven days as part of a redundant network designed to survive takedowns. RSA reported that Troyak is one of five upstream providers surrounding eight "bulletproof networks" hosting malware including ZeuS, Gozi and the RockPhish phishing operation, and that the other four providers' own regional ISP connections let the hosted networks reconnect.
What you should know: The takedown failed to keep the criminal hosting offline because redundancy, not any single provider, is what holds the operation up - and RSA notes most of the bulletproof networks were back online through alternate connections within the same infrastructure.
Read the original at Krebs on Security ↗
- Topics
- Cybercrime & Law Enforcement
- Related
- Gootloader Malware Disrupted After Infecting 25,000 Computers Cyber Risks · Nov 13, 2026354 dark web vendors and buyers arrested in Operation Tor Nado Cyber Risks · Nov 13, 2026Law Enforcement Disrupts Gootloader, CastleRAT, and StealC Infrastructure Cyber Risks · Nov 13, 2026