CyberzSOC

interagency body established by Congress in the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) to ensure unity of effort in combating the growing threat of ransomware attacks. This document provides internet service providers (ISPs) and network defenders recommendations to mitigate potential cybercriminal activity enabled by bulletproof hosting (BPH) providers. This document is authored by the Cybersecurity and Infrastructure Security Agency (CISA) and the following partners:1 A BPH provider is an internet infrastructure provider that knowingly and intentionally markets and leases their infrastructure to cybercriminals. The authoring agencies have observed a marked increase in cybercriminal actors using BPH infrastructure to support cyber operations against critical infrastructure, financial institutions, and other high-value targets. BPH providers continue to pose a significant risk to the resilience and safety of critical systems and services. Mitigating cybercriminal activity enabled by BPH providers requires a nuanced approach because BPH infrastructure is integrated into legitimate internet infrastructure systems, and actions from ISPs or network defenders may impact legitimate activity.