Loading story…
New Zealand imposed sanctions on 33 Russian individuals and entities for supporting Russia’s war against Ukraine through cyberattacks, propaganda, intelligence activity, and sanctions evasion. The measures target members of the pro-Russian hacktivist group Cyber Army of Russia Reborn (CARR), figures linked to Russia’s military intelligence service including GRU Unit 29155, and an alleged operator of the Media Land bulletproof hosting service.
The sanctions also name the Kremlin-backed Internet Development Institute and Russian IT company LANIT, which New Zealand said were involved in malign activity tied to Moscow’s aggression. Officials said Russian cyber actors are being used to gather intelligence, disrupt opponents, and help sustain the broader war effort, and described the move as part of a coordinated response that aligns with earlier sanctions and public attributions by the United States, United Kingdom, Canada, Ukraine, and New Zealand.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
New Zealand announced new sanctions targeting 33 Russian individuals and entities for supporting Russia's war against Ukraine through cyberattacks, propaganda, and other malign activity. The designations included alleged CARR members, Media Land-linked Aleksandr Volosovik, GRU-linked figures, the Internet Development Institute, and LANIT.
The U.S. Treasury sanctioned Yuliya Pankratova and Denis Degtyarenko in 2024 over alleged cyber operations targeting U.S. critical infrastructure. U.S. officials identified Pankratova as the leader of Cyber Army of Russia Reborn and Degtyarenko as one of its primary hackers.
New Zealand said it has imposed sanctions on more than 2,000 Russian individuals, entities, and vessels since Russia's full-scale invasion of Ukraine began in February 2022.
The U.S. Justice Department unsealed charges in July against Aleksandr Volosovik and two other Russian nationals. Prosecutors accused Volosovik of helping operate the Media Land bulletproof hosting service, which was allegedly used in attacks on hospitals, schools, and banks.
New Zealand had already sanctioned members of GRU Unit 29155 in September over malicious cyber activity targeting Ukraine and other countries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New Zealand has sanctioned Russian military intelligence hackers from GRU Unit 29155 for cyberattacks on Ukraine, including the 2022 WhisperGate malware incident. The sanctions include asset freezes, travel bans, and prohibitions on financial dealings with the designated entities. This move aligns with similar actions by the EU, UK, and US, targeting the unit for its destructive cyber campaigns and espionage activities.
Jun 29, 2026
The United States, United Kingdom, and Australia have jointly imposed sanctions on Media Land, a Russian bulletproof hosting provider, along with its leadership and affiliated companies, for facilitating ransomware operations and other cybercrimes. Media Land has been identified as a critical infrastructure provider for major ransomware groups such as LockBit, BlackSuit, and Play, offering services that enable these actors to evade law enforcement and conduct attacks against businesses and critical infrastructure in the U.S. and allied countries. The sanctions also extend to related entities, including Hypercore Ltd. and Aeza Group, and target individuals responsible for managing and supporting these operations. Authorities highlighted that Media Land's infrastructure was used not only for ransomware but also for distributed denial-of-service (DDoS) attacks and other illicit activities, with its executives actively coordinating with cybercriminals and providing operational support. In parallel with the sanctions, U.S. and international cyber agencies released new guidance to help internet service providers and network defenders mitigate risks from bulletproof hosting providers. The guidance recommends measures such as curating malicious resource lists, implementing network filters, monitoring traffic for anomalies, and sharing threat intelligence to disrupt the infrastructure that enables ransomware and other cyber threats. These coordinated actions underscore a broader effort by Western governments to dismantle the technical and financial networks that sustain global cybercrime operations, particularly those emanating from Russia and its network of bulletproof hosting services.
Aug 7, 2026
The European Union imposed sanctions on eight individuals accused of participating in Russian-linked cyberattacks and cybercrime, targeting figures tied to **Conti**, **TrickBot**, **Wizard Spider**, **LockBit**, **EvilCorp**, **BlackBasta**, the **Lumma** infostealer, and the pro-Russian **Cyber Army of Russia Reborn**. Those named include alleged Conti leader Vitaly Nikolayevich Kovalev, bulletproof hosting operator Alexander Volosovik, two operators associated with Lumma, two members linked to Cyber Army of Russia Reborn, and two alleged members of **GRU Unit 29155**. The sanctions were issued amid broader Western attribution of Russian state and criminal cyber activity, including disruptive operations against Ukraine and its supporters and espionage and sabotage campaigns linked to the GRU. UK government reporting has profiled Russian military intelligence cyber and hybrid operations, including activity attributed to **Unit 29155**, while the EU action also cites links to the **WhisperGate** campaign and follows French accusations of Russian cyber espionage. The measures underscore continued efforts to publicly identify and financially isolate operators supporting both state-directed and criminal cyber operations.
Jul 20, 2026