CISA/FBI/NSA Unite to Dismantle Bulletproof Hosting Ecosystem with New Global Defense Guide

According to CISA—alongside the NSA, FBI, DoD Cyber Crime Center, and international cybersecurity partners—a joint announcement has published a comprehensive guide aimed at dismantling the global ecosystem of bulletproof hosting providers, the infrastructure powering ransomware, phishing, data theft and other cybercrime operations.

The guide, titled Bulletproof Defense: Mitigating Risks From Bulletproof Hosting Providers, marks one of the most unified global efforts yet to combat criminal hosting networks and includes the definition that “A BPH provider is an internet infrastructure provider that knowingly and intentionally markets and leases their infrastructure to cybercriminals.” It notes that such

providers are deeply embedded in campaigns targeting critical infrastructure, financial institutions and high‑value enterprises, often enabling ransomware groups and other threat actors to operate with impunity, while outlining how BPH operators use permissive abuse policies, fraudulent sign-up schemes, jurisdictional arbitrage and infrastructure obfuscation.

The document recommends precision filtering rather than broad ASN blocking, emphasising the need to balance blocking malicious activity with avoiding collateral damage, and sets out key ISPs duties such as notifying customers when filters may affect availability and implementing secure‑by‑design practices.