Report: German ISP tapped for illicit hosting infrastructure

Numerous threat activity enablers leveraged German hosting provider aurologic GmbH as a primary upstream provider.

GBHackers News reports that numerous threat activity enablers, including Railnet, Global-Data System IT Corporation, metaspinner net GmbH, Femo IT Solutions Ltd, and the recently sanctioned Aeza Group, have leveraged German hosting provider aurologic GmbH as a primary upstream provider.

Aside from continuously providing upstream connection to Aeza International, which has been sanctioned by the U.S. and UK, aurologic also helped support WAIcore Hosting Ltd, Tnsecurity Ltd, and Daniil Yevchenko's Altawk operation, which are Russia-linked infrastructure, according to a report from Recorded Future's Insikt Group.

Additional findings showed that aurologic was among the top 10 in terms of malicious activity concentration as of September, with the firm's attractiveness to potential threat networks attributed to its self-proclaimed neutrality and the perception of reduced enforcement risk in the EU.

Upstream network providers were urged to ensure adherence to legal obligations and ethics in operations to curb potential targeting of critical infrastructure entities.

Written by

Sharon Florentine Editorial Director

Sharon Florentine is the editorial director for CyberRisk Alliance’s Channel Brands and acting editorial director for SC UK. She is responsible for setting strategy and editorial direction and developing content for news, features, analysis and other written content, moderates live webcasts, and oversees research projects. Sharon has previously held key editorial, content and leadership positions at DevOps.com, Security Boulevard, CIO.com, Ziff Davis Enterprise, and CRN, among others.