Loading threat actor…
Aeza Group is a Russia-linked bulletproof hosting provider that has been publicly identified as enabling cybercriminal and influence operations by supplying abuse-resistant infrastructure and related support services. The organization has been associated with hosting used for stealer malware and ransomware operations, dark web criminal marketplaces, and pro-Russian disinformation activity. Reported malware and ransomware customers or users of its infrastructure include BianLian, RedLine, Meduza, and Lumma. Aeza has also been linked to a UK-based front company, Hypercore, allegedly used to rebrand and shift infrastructure in an effort to evade sanctions and obscure ties to new technical assets. Reporting has additionally linked Aeza to the Kremlin-connected Social Design Agency disinformation organization. As a bulletproof hosting provider rather than a conventional intrusion set, Aeza Group’s role is primarily as an enabler within the cybercrime ecosystem. Its capabilities center on providing resilient infrastructure for malicious operations, helping customers withstand abuse complaints, law-enforcement pressure, and takedown efforts. This support materially facilitates malware delivery, ransomware deployment, criminal marketplace operations, and broader post-compromise activity by downstream actors. Public sanctions actions have characterized Aeza as part of the infrastructure layer underpinning ransomware ecosystems and other illicit online operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Aeza Group is a Russia-linked bulletproof hosting provider that has supported cybercrime operations and attempted to evade sanctions by rebranding and moving infrastructure to UK-based entities.
Aeza Group is a bulletproof hosting provider previously sanctioned for supporting cybercrime, with Hypercore acting as a front company.
Aeza Group is a bulletproof hosting company previously sanctioned for supporting cybercriminal operations and is linked to Kremlin disinformation activities via the Social Design Agency.
Aeza Group is a Russian bulletproof hosting provider sanctioned for enabling the delivery of stealer malware and ransomware, as well as hosting illicit marketplaces.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.