Loading threat actor…
Yalishanda is the long-running underground identity of Aleksandr Volosovik, a Russian-linked bulletproof hosting operator associated with Media Land and related infrastructure businesses. Active since approximately 2009, Yalishanda has been widely characterized as a top-tier provider of abuse-resistant hosting and support services for cybercriminal customers in the Russian-speaking ecosystem. Known aliases include Aleksandr Volosovik, Downlow, Stas_vl, and Ohyeahhellno, and the infrastructure has also been associated with Media Land and Data Center Kirishi. Yalishanda’s services have supported a broad range of criminal activity, including phishing operations, cybercrime forums, malware delivery, banking trojan infrastructure, spoofed portals, stolen-card shops, and ransomware operations. Reporting has linked Yalishanda-hosted infrastructure to malware families and operations including ERMAC, Dridex, Zeus, and BlackBasta, and sanctions reporting also tied the network to support for ransomware actors including LockBit. The operation offered hosting, technical support, domain registration, and abuse-resistant services designed to keep malicious infrastructure online despite complaints or law-enforcement pressure. Operationally, Yalishanda functioned as an enabling actor rather than primarily as a malware developer or intrusion operator. The actor’s infrastructure was used to host command-and-control systems, malware distribution points, phishing content, and anonymization layers for criminal customers. Leaked internal data and sanctions actions in 2025 further connected Media Land and its personnel to direct support for BlackBasta’s ransomware operations, including server provisioning, bandwidth scaling, proxy support, and customer assistance. Kirill Zatolokin, also known as Slim Shady, has been identified as a support and infrastructure operator linked to the same network. The actor has been publicly tied to Russia-based corporate fronts and was sanctioned in 2025 by the United States in coordination with the United Kingdom and Australia for enabling cybercriminal activity. Yalishanda is best understood as a major cybercrime infrastructure provider whose core role has been to furnish resilient hosting and operational support to financially motivated criminal actors, including ransomware groups and banking malware operators.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Attributed origin per open-source reporting.
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
8 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Bulletproof hosting provider and infrastructure front tightly connected to cybercrime, offering hosting, technical support, domain registration, and abuse-resistant services to ransomware operators including BlackBasta.
Bulletproof hosting provider associated with infrastructure used by ERMAC command-and-control operations.
Aleksandr Volosovik, known as Yalishanda, operates bulletproof hosting services that support a wide range of cybercriminal activities, including ransomware, laundering, and underground exchanges. He is linked to thousands of cryptocurrency addresses and millions of dollars in transactions.
Operator of long-running bulletproof hosting services used to support phishing sites, cybercrime forums, malware distribution, banking trojans, ransomware operations, and other criminal infrastructure.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.