Summary Points
- Dutch law enforcement seized over 800 servers from THE.Hosting but failed to disrupt its ongoing malicious activities, highlighting the resilience of cybercriminal infrastructure.
- Despite seizures, scanning activity from THE.Hosting persists at high levels, targeting a broad range of systems including databases and industrial control systems.
- THE.Hosting has migrated multiple times, using complex infrastructure maneuvers to evade sanctions and law enforcement, maintaining a presence across several countries.
- The operation’s impact is limited; without international collaboration to block IP address space, the cybercriminal activities are likely to continue unabated.
Dutch Raid Fails to Disrupt Russian Bulletproof Hosting
Recently, Dutch law enforcement tried to shut down a cybercriminal network called THE.Hosting. On May 18, they seized over 800 servers and arrested two people linked to the network. This network supports illegal activities tied to Russian hackers. However, the operation barely slowed down the ongoing malicious activity. Despite the seizure, the scanning activity from the network continued almost as before. Researchers noted that the cybercriminals’ operations remain resilient, even after authorities acted. The criminals use the network to recruit devices, drop malware, steal credentials, and attack other systems. Their methods show how difficult it is for law enforcement to take these networks offline.
Why the Takedown Didn’t Stop the Threat
The main reason the raid was ineffective is that the criminals’ digital tools still exist. They operate across multiple countries and use complex tactics to stay ahead. When authorities seized servers in the Netherlands, the cybercriminals quickly shifted their activities to other locations. Their address blocks, assigned to Dutch companies, are geolocated in many countries, including the US, Germany, and the UK. As a result, traffic and scans continue from these different places. Experts say the best way to stop such networks involves international cooperation to block entire address spaces. Until then, these cybercriminals can quickly recover and keep their malicious work ongoing.
Expand Your Tech Knowledge
Learn how the Internet of Things (IoT) is transforming everyday life.
Discover archived knowledge and digital history on the Internet Archive.
CyberRisk-V1
