Notorious Malware, Spam Host “Prospero” Moves to Kaspersky Lab
Summary: Spamhaus observed that Prospero OOO, a Russia-based bulletproof hosting provider long tied to malware, botnet controllers and phishing, began routing its traffic through networks operated by Kaspersky Lab in Moscow, a relationship Kentik routing records date to the beginning of December 2024. Kaspersky denied the claims, stating it does not work and has never worked with the provider and that routing through its networks does not by default mean provision of its services, while saying it is investigating which network served as transit.
Key Takeaway: Prospero has hosted control servers for multiple ransomware gangs and malware operations such as SocGholish and GootLoader, and Intrinsec's phishing data ranked it with a higher spam score than any other provider - so traffic now transiting Kaspersky's AS209030 is traffic your existing blocklists may not expect to see from that source.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026