Project Aspis will help hosting providers remove persistent criminal activity from their networks before it spreads to end users
Following its disruption of a major distributor of Angler ransomware, Cisco is offering up free security consulting for hosting providers that’s aimed at wiping out persistent attacks that abuse providers’ services and threaten the rest of the Internet.
Cisco’s Talos security intelligence and research group has launched Project Aspis, which hosting providers can sign up for to work with Talos and in return receive help including systems forensics, reverse engineering, threat intelligence sharing and, in the right circumstances, dedicated research engineers to work with, according to Cisco’s security blog.
“This collaboration will help the hosting provider maintain a safe and cost-effective environment and assist Talos in its mission of pissing off the bad guys,” the Talos team says in the blog.
The project stems from Cisco’s work with hosting provider Limestone Networks to glean insight into how criminals ran Angler ransomware operations. Talos researchers traced significant Angler activity to Limestone, then enlisted that company’s assistance to gather data on how the Angler group did business and shut down its activity at Limestone.
The effort saved Limestone money because the Angler group bought servers from Limestone using stolen credit cards. When the credit card companies found out, Limestone was hit with charge-backs amounting to $10,000 per month.
Project Aspis offers similar assistance to other providers willing to sign up, which they can do via email at firstname.lastname@example.org. Cisco wants the name and contact information for the providers’ point person, a description of the problem they want help with, forensic details they can share and indicators of compromise they are leveraging.
Aspis is the name for a heavy wooden shield used in Ancient Greece.