7/ Femo IT Solutions Ltd #AS214351 is a UK-registered network with close operational ties to self-proclaimed bulletproof hoster “Defhost”, who offer “Germany-only” abuse-resilient services on underground forums.

3/ Among the highest risk networks are: The recently sanctioned Aeza Group #AS210644, Railnet LLC #AS214943, Global-Data System IT Corp aka SWISSNETWORK02 #AS42624, and Femo IT Solutions #AS214351.

A significant amount of #CastleLoader C2 infrastructure identified by @julianferdinand.bsky.social was tied to #ThreatActivityEnabler 🇬🇧 FEMO IT SOLUTIONS #AS214351 utilising 🇩🇪 aurologic GmbH #AS30823 as their sole upstream provider. One to watch out for!