Bulletproof Hosting Founder Imprisoned for Helping Cybercrime Gangs

34-year-old Russian Aleksandr Grichishkin, the founder of a bulletproof hosting service, was sentenced to 60 months in prison for allowing cybercrime gangs to use the platform in attacks targeting US financial institutions between 2008 to 2015.

Grichishkin, who was also the organization’s leader, provided multiple cybercrime operations with the infrastructure (IP addresses, servers, and domains) needed to distribute malware, host phishing kits, breach targets’ networks, build botnets, and steal banking credentials.

According to the sentencing memorandum, malware hosted on the organization’s bulletproof hosting platform—including Zeus, SpyEye, Citadel, and the Blackhole Exploit Kit—was used in attacks against U.S. organizations and caused millions of dollars in losses.

Also Read: Buying Paper Shredder Singapore: 5 Important Factors to Consider

As revealed in court documents, the US Federal Deposit Insurance Corporation (FDIC) estimated that just SpyEye and Zeus attacks caused roughly $64 million in damages to banks and their corporate clients in a single year, based on incidents in 2011.

He also aided cybercrime clients to register new infrastructure using false or stolen identities to circumvent law enforcement efforts to block their attacks.

“Grichishkin also helped clients evade detection by law enforcement and continue their crimes uninterrupted by monitoring sites used to blocklist technical infrastructure used for crime, moving ‘flagged’ content to new infrastructure, and registering all such infrastructure under false or stolen identities,” the DOJ added.

Responsible for millions of dollars in damages

The bulletproof hosting organization was founded by Russian citizens Andrei Skvortsov and Aleksandr Grichishkin. They hired Lithuanian Aleksandr Skorodumov and Estonian Pavel Stassi, who were also previously sentenced to four and two years in prison, respectively, as the hosting service’s administrator and system admin.

While Skorodumov and Stassi were the ones responsible for keeping systems running and helping cybercrime operations optimize their “services,” the two founders oversaw marketing, personnel management, and client support.

Also Read: Letter of Consent MOM: Getting the Details Right

All four defendants have pleaded guilty to one count of RICO conspiracy in May 2021. Skvortsov, the second bulletproof hosting founder, faces a maximum penalty of 20 years in prison.

“Over the course of many years, the defendants facilitated the transnational criminal activity of a vast network of cybercriminals throughout the world by providing them a safe-haven to anonymize their criminal activity,” said FBI Special Agent in Charge Timothy Waters.

“This resulted in millions of dollars of losses to U.S. victims. Today’s guilty plea sends a message to cybercriminals across the globe that they are not beyond the reach of the FBI and its international partners, and that anyone who facilitates or profits from criminal cyber activity will be brought to justice.”