Supporting infrastructure is the digital layer that helps a criminal network operate: hosting services, command-and-control servers, email systems, proxy chains, domains, messaging accounts, and other tools used to communicate, store data, and coordinate activity. It is not always the malicious payload itself, but it is what keeps the operation reachable, resilient, and repeatable.
In cyber security, this matters because attacking the infrastructure can weaken an entire ecosystem, not just one user or malware sample. Defenders and investigators look for shared servers, reused domain patterns, registrar accounts, and traffic relays to map relationships and disrupt operations. When this layer is taken down or monitored, criminals may lose access to victims, experience delayed communications, or be forced to rebuild and fragment their operations. That makes supporting infrastructure a key target in both crime-as-a-service investigations and broader disruption efforts.