Takedowns Are Not Kills: Inside the Cybercrime Infrastructure Supply Chain
Source: YouTube · SANS Digital Forensics and Incident Response · published Sep 17, 2026 · 1:00:16
BLUF: This session explores the cybercriminal infrastructure ecosystem, emphasizing that defenders must pivot from static IOCs to behavioral analysis of ASN reputation, residential proxies, and AI-powered attack tools to effectively detect and mitigate threats.
Key Takeaways:
• Bulletproof hosting providers serve as the foundational layer for cybercrime by offering resilient infrastructure that resists takedowns, hosting C2 panels, malware distribution, and darknet markets while utilizing IP rotation and rebranding to evade law enforcement 2:15.
• Defenders should analyze ASN-level risk rather than just individual IPs, using behavioral heuristics like scanning and brute-forcing patterns to identify "risky" ranges, though caution is required to avoid blocking legitimate services hosted on the same infrastructure 15:54.
• Residential proxy networks, such as those using malicious SDKs in Android apps, allow attackers to blend in with legitimate home user traffic, making traditional takedown efforts difficult and requiring contextual enrichment of login logs to detect compromised identities 25:36.
• Tracking infrastructure requires leveraging open-source tools like Shodan and URLScan to fingerprint specific server banners, TLS handshakes (JARM), and certificates, which helps identify compromised IoT devices and botnets used in Orb Relay Networks 23:51.
• The emergence of AI tools like Cyber Strike AI represents a significant shift, with a rapid increase in AI-enabled C2 servers used for automated penetration testing and attack generation, often linked to state-affiliated actors leveraging free API keys 49:13.
Closing Statement:
To build resilience, defenders must enrich identity logs with IP context feeds, create custom fingerprints for known malicious tools, and monitor for Tor egress to disrupt the criminal supply chain effectively.
Sources:
- 2:15 Definition and role of bulletproof hosting providers in the criminal ecosystem.
- 15:54 Strategic benefits and risks of tracking infrastructure at the ASN level.
- 25:36 Mechanism and detection challenges of residential proxy networks.
- 23:51 Use of open-source tools for fingerprinting and identifying malicious infrastructure.
- 49:13 Analysis of the rapid adoption of AI tools like Cyber Strike AI by threat actors.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 1 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Cybersecurity. Commonly maps to: Security and Risk Management, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
[music] Heat. Heat. [music] >> [music] [music] >> Hey everybody, welcome one, welcome all to the SANS threat analysis rundown or STAR for short. Uh, as always, this is a practitioner first focused live stream. Uh, no vendor pitches. It's really just what value can we add to blue team and and uh defenders and things for uh all all of the different folks that uh need need something that they can apply to their day-to-day job uh on Monday. Um today we're going to be focused on the infrastructure layer uh underneath uh kind of everything that supports the criminal ecosystem and kind of how we can pivot and not only identify indicators but recognize sort of the supply chain that uh makes up the the the criminal ecosystem, the threat actor ecosystem uh that relies on said infrastructure. But bef…