US charges three Russians over bulletproof hosting services used by ransomware gangs
US federal prosecutors have unsealed an indictment against three Russian nationals accused of running “bulletproof” hosting operations that served ransomware gangs and other cybercriminals, BleepingComputer reports. The services in question, Media Land and ML.Cloud, are linked to attacks that caused more than $62 million in damages to victims worldwide.
Bulletproof hosting providers rent out server infrastructure while deliberately ignoring abuse complaints and law-enforcement takedown requests, making them a critical enabler of malware delivery, command-and-control operations, and phishing campaigns. According to the indictment, Aleksandr Volosovik — known on criminal forums as “Yalishanda” — owned Media Land, Yulia Pankova owned ML.Cloud and handled legal and financial matters, and Kirill Zatolokin collected customer payments. The companies offered infrastructure not only in Russia but also in China, Finland, the Netherlands, and the United States.
The charges build on earlier pressure against the group. The US, UK, and Australia sanctioned the three defendants and their companies in November over infrastructure and support provided to ransomware operations including LockBit, BlackSuit, and Play, and the EU and UK have since added the entities to their first joint cyber sanctions package against Russia. The US State Department is also offering a reward of up to $10 million through its Rewards for Justice program for information on foreign government-linked associates of the defendants.
Prosecutors said victims of attacks facilitated by the services span at least 21 US states and include banks, schools, hospitals, government entities, and media companies, with Media Land infrastructure also reportedly used to launch DDoS attacks against US critical infrastructure.