Loading story…
U.S. prosecutors unsealed an indictment against three Russian nationals — Aleksandr Volosovik, Yulia Pankova, and Kirill Zatolokin — and two St. Petersburg-based companies, Media Land LLC and ML.Cloud LLC, accusing them of running a bulletproof hosting service that helped cybercriminals evade law enforcement. Authorities allege the companies provided infrastructure, internet services, and technical support for ransomware, malware, phishing, brute-force, DDoS, and fraud operations, and that the service was used by groups including LockBit, BlackSuit, and Play as well as stolen-card marketplaces.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
A federal grand jury returned an indictment against Aleksandr Volosovik, Yulia Pankova, Kirill Zatolokin, Media Land LLC, and ML.Cloud LLC in connection with alleged bulletproof hosting services that supported cybercrime. The indictment preceded its later public unsealing by the U.S. Attorney’s Office for the Northern District of Ohio.
At the same time as the indictment was unsealed, the U.S. State Department offered up to $10 million through Rewards for Justice for information on the defendants, their associates, and possible foreign government links to the hosting services' activities.
U.S. federal prosecutors unsealed an indictment charging Aleksandr Volosovik, Yulia Pankova, and Kirill Zatolokin, along with Media Land LLC and ML.Cloud LLC, for allegedly operating bulletproof hosting services that supported cybercrime. Prosecutors said the infrastructure aided ransomware, malware, phishing, DDoS, brute-force, and fraud activity and was tied to more than $62 million in victim losses.
The UK government announced measures against Russian cybercrime networks it said were responsible for attacks on UK businesses. The announcement was published by GOV.UK on 2025-11-19 and represents a distinct official UK action in the broader case involving Russian cybercrime infrastructure.
Coordinated sanctions were announced against the St. Petersburg-based bulletproof hosting providers Media Land and ML Cloud. Later reporting says the criminal case followed these sanctions announced in November 2025.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
15 references tracked. Mallory keeps watching after this page renders.
cyberaccord.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcecyberscoop.com
Open sourcetherecord.media
Open sourcerewardsforjustice.net
Open sourcegov.uk
Open sourcecisa.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The United States, United Kingdom, and Australia have jointly imposed sanctions on Media Land, a Russian bulletproof hosting provider, along with its leadership and affiliated companies, for facilitating ransomware operations and other cybercrimes. Media Land has been identified as a critical infrastructure provider for major ransomware groups such as LockBit, BlackSuit, and Play, offering services that enable these actors to evade law enforcement and conduct attacks against businesses and critical infrastructure in the U.S. and allied countries. The sanctions also extend to related entities, including Hypercore Ltd. and Aeza Group, and target individuals responsible for managing and supporting these operations. Authorities highlighted that Media Land's infrastructure was used not only for ransomware but also for distributed denial-of-service (DDoS) attacks and other illicit activities, with its executives actively coordinating with cybercriminals and providing operational support. In parallel with the sanctions, U.S. and international cyber agencies released new guidance to help internet service providers and network defenders mitigate risks from bulletproof hosting providers. The guidance recommends measures such as curating malicious resource lists, implementing network filters, monitoring traffic for anomalies, and sharing threat intelligence to disrupt the infrastructure that enables ransomware and other cyber threats. These coordinated actions underscore a broader effort by Western governments to dismantle the technical and financial networks that sustain global cybercrime operations, particularly those emanating from Russia and its network of bulletproof hosting services.
Aug 7, 2026
Leaked internal records exposed how the **Black Basta** ransomware operation relied on the bulletproof hosting provider **Media Land** (also known as **Yalishanda**) for servers, domains, proxy services, bandwidth, and technical support. A leak of roughly 190,000–200,000 Black Basta Matrix chat messages, followed by a leak of Media Land’s internal database, revealed operational links between the two organizations and identified **Aleksandr Volosovik** as the operator behind Yalishanda and **Kirill Zatolokin** (aka **Slim Shady**) as a support and infrastructure operator who bridged Media Land and Black Basta. The disclosures showed Black Basta functioning as a structured ransomware enterprise that used cryptocurrency to pay for infrastructure and maintained abuse-resistant services through a registered front company. The leaked chats and subsequent research also detailed Black Basta’s attack methods across critical infrastructure victims, including phishing, Microsoft Teams and fake IT-support social engineering, exploitation of known vulnerabilities, and use of malware such as **Qakbot**, **Pikabot**, **DarkGate**, **LummaC2**, and **Cobalt Strike**. Researchers found the group abused **EV code-signing certificates**, reused credentials, created corporate-looking domains, and discussed zero-day and CVE exploitation while running double-extortion campaigns. U.S. and allied authorities later sanctioned Media Land, its subsidiary **Data Center Kirishi**, Volosovik, and Zatolokin for supporting cybercrime, underscoring how infrastructure providers enabled Black Basta’s global ransomware operations.
Aug 15, 2026
Threat intelligence reporting identified bulletproof hosting as a key enabler of long-running cybercrime campaigns, with providers such as **Void Griffon** offering dedicated servers, VPS/VDS instances, domain registration, API access, and **FastFlux** services that kept malicious infrastructure online for years. Researchers found that multiple malware families and phishing operations relied on these resilient services, while broader analysis showed criminals also combining compromised servers, cloud assets, botnets, proxies, VPNs, Tor, dynamic DNS, and decentralized DNS to support command-and-control, spam, fraud, data exfiltration, and ransomware deployment. Additional investigations tied shared hosting patterns to coordinated malicious infrastructure used for **Magecart**, **IcedID**, **Qakbot**, **Ursnif**, and brand-spoofing phishing campaigns, with synchronized IP rotation and recurring registrar and nameserver choices suggesting infrastructure-as-a-service for cybercrime. Intrinsec later linked a reused SSH fingerprint across about **138 servers** to **ShadowSyndicate**, connecting that infrastructure to **LockBit**, **Cl0p/TrueBot**, **RansomHub**, **Cicada3301**, **Atomic macOS Stealer**, and **RustDoor**, and assessed that the group likely depended on Russian-operated bulletproof hosting designed to resist takedowns while continuing to scan for vulnerabilities and deliver payloads.
Aug 15, 2026