The Companies Behind the Hackers: How Europe Is Targeting Cybercrime's Hidden Backbone
Jul 30, 2026
When people think about cybercrime, they usually picture ransomware gangs, darknet marketplaces or anonymous hackers.
But behind almost every major cyberattack is another player that rarely makes headlines.
The companies that provide the infrastructure.
Without servers, domains and hosting, many cybercriminal operations simply couldn't function.
Now, European authorities are trying a different approach.
Instead of only chasing the hackers, they're going after the businesses that allegedly help keep those criminal operations online.
The Invisible Industry
This month, the European Union imposed sanctions on two Russian companies, their chief executive and another individual accused of playing a key role in organised cybercrime.
According to Dutch police and prosecutors, the companies operated as so-called "bulletproof hosting" providers—businesses that allegedly offered cybercriminals a safe place to host malware, phishing campaigns, ransomware infrastructure and botnets while attempting to shield them from law enforcement.
Unlike ordinary web-hosting companies, bulletproof hosting services are accused of advertising themselves specifically to clients involved in criminal activity.
Authorities say customers could receive hosting, domain registration, technical support and protection against attempts to shut down their infrastructure.
Why They Matter
Investigators believe these services have become one of the most important pieces of the cybercrime ecosystem.
Rather than writing ransomware themselves, the providers allegedly supply the digital foundations that allow criminal groups to operate around the world.
According to Dutch authorities, infrastructure linked to the sanctioned companies had been used by well-known ransomware groups including LockBit, Black Basta and Cl0p.
Without reliable infrastructure, many attacks would become much harder to coordinate.
A Different Kind of Takedown
Instead of announcing arrests, European authorities chose another strategy.
The sanctions freeze assets within the EU, prohibit business dealings with the sanctioned entities and restrict travel for those involved.
The goal isn't simply punishment.
It's to make operating these services financially and logistically much more difficult.
Investigators hope that by disrupting the businesses supporting cybercriminals, they can weaken multiple ransomware groups at the same time.
The New Battlefield
For years, law enforcement focused on identifying individual hackers.
Today, the strategy appears to be changing.
Rather than chasing every ransomware affiliate separately, authorities are increasingly targeting the infrastructure that many criminal groups rely on.
It's a reminder that cybercrime has become an entire industry—not just isolated criminals behind keyboards.
And in modern investigations, taking away the foundation may prove just as effective as arresting the people using it.
Discussion
If law enforcement succeeds in shutting down the infrastructure that supports cybercriminals, will ransomware groups simply move elsewhere, or could targeting their hosting providers have a lasting impact on organised cybercrime?
But behind almost every major cyberattack is another player that rarely makes headlines.
The companies that provide the infrastructure.
Without servers, domains and hosting, many cybercriminal operations simply couldn't function.
Now, European authorities are trying a different approach.
Instead of only chasing the hackers, they're going after the businesses that allegedly help keep those criminal operations online.
The Invisible Industry
This month, the European Union imposed sanctions on two Russian companies, their chief executive and another individual accused of playing a key role in organised cybercrime.
According to Dutch police and prosecutors, the companies operated as so-called "bulletproof hosting" providers—businesses that allegedly offered cybercriminals a safe place to host malware, phishing campaigns, ransomware infrastructure and botnets while attempting to shield them from law enforcement.
Unlike ordinary web-hosting companies, bulletproof hosting services are accused of advertising themselves specifically to clients involved in criminal activity.
Authorities say customers could receive hosting, domain registration, technical support and protection against attempts to shut down their infrastructure.
Why They Matter
Investigators believe these services have become one of the most important pieces of the cybercrime ecosystem.
Rather than writing ransomware themselves, the providers allegedly supply the digital foundations that allow criminal groups to operate around the world.
According to Dutch authorities, infrastructure linked to the sanctioned companies had been used by well-known ransomware groups including LockBit, Black Basta and Cl0p.
Without reliable infrastructure, many attacks would become much harder to coordinate.
A Different Kind of Takedown
Instead of announcing arrests, European authorities chose another strategy.
The sanctions freeze assets within the EU, prohibit business dealings with the sanctioned entities and restrict travel for those involved.
The goal isn't simply punishment.
It's to make operating these services financially and logistically much more difficult.
Investigators hope that by disrupting the businesses supporting cybercriminals, they can weaken multiple ransomware groups at the same time.
The New Battlefield
For years, law enforcement focused on identifying individual hackers.
Today, the strategy appears to be changing.
Rather than chasing every ransomware affiliate separately, authorities are increasingly targeting the infrastructure that many criminal groups rely on.
It's a reminder that cybercrime has become an entire industry—not just isolated criminals behind keyboards.
And in modern investigations, taking away the foundation may prove just as effective as arresting the people using it.
Discussion
If law enforcement succeeds in shutting down the infrastructure that supports cybercriminals, will ransomware groups simply move elsewhere, or could targeting their hosting providers have a lasting impact on organised cybercrime?