Russian Man Gets 60 Months Jail for Providing Bulletproof Hosting to Cyber Criminals

A Russian national charged with providing bulletproof hosting
services for cybercriminals, who used the platform to spread
malware and attack U.S. organizations and financial institutions
between 2009 to 2015, has received a 60-month prison sentence.

34-year-old Aleksandr Grichishkin, along with Andrei Skvortsov,
founded the bulletproof hosting service and rented its
infrastructure to other criminal clientele for distributing a wide
range of malware and attempted to cause millions of dollars in
losses to U.S. victims.

Skvortsov is pending sentencing and faces a maximum penalty of
20 years in prison.

Bulletproof hosting operations are similar to regular web
hosting, but are a lot more lenient about what can be hosted on
their servers. They are known for providing secure hosting for
malicious content and activity and assuring anonymity to threat
actors.

Grichishkin, in May, pleaded guilty^[1]
to conspiracy to engage in a racketeer-influenced corrupt
organization (RICO). Acting as the firm’s “day-to-day-leader,” he
is also said to have helped customers evade detection by law
enforcement and continue their crimes uninterrupted by monitoring
sites used to blocklist IP addresses, servers, and domains and
moving the affected clients’ data to “clean” infrastructure that
was registered under false or stolen identities.

“He oversaw efforts to advertise the organization’s bulletproof
hosting services in online cybercrime forums, set pricing for these
services, negotiated and interfaced with clients seeking internet
infrastructure to be used in spamming and malware operations,
managed employee hiring and compensation, and supervised the
systems administrators’ and other employees’ work,” the U.S.
Justice Department said^[2]
in a statement.

The development is the latest in a long saga that ended in two
of the scheme’s co-conspirators — Pavel Stassi, 30, of Estonia, and
Aleksandr Shorodumov, 33, of Lithuania — receiving a jail term of 24 months and 48
months^[3] in prison respectively
in October for their roles as the lead systems administrator in the
organization and for marketing its services to criminal actors as
well as utilizing fraudulent information to register the web
hosting and financial accounts.