In a coordinated international effort, the United States, United Kingdom, and Australia have announced sweeping sanctions against two major bulletproof hosting providers and several individuals accused of enabling global cybercrime operations. The move marks one of the strongest actions yet against infrastructure that supports ransomware, phishing campaigns, and data-extortion schemes.
Media Land Sanctioned for Supporting Ransomware Groups
The U.S. Treasury Department, alongside its Five Eyes partners, imposed sanctions on Russia-based Media Land, three of its executives, and affiliated companies. Authorities say the provider has long served as a safe haven for ransomware groups, including LockBit, BlackSuit, and Play — some of the most damaging cybercriminal organizations operating today.
Those sanctioned include:
- Alexsandr Volosovik, Media Land’s general director
- Kirill Zatolokin
- Yulia Pankova
Subsidiaries targeted include ML Cloud, Media Land Technology, and Data Center Kirishi.
“Media Land has been impactful largely because of its longevity,” said Allan Liska, threat intelligence analyst at Recorded Future. “Targeting this kind of infrastructure can disrupt the ransomware ecosystem … it makes it much more difficult for these actors to continue operating.”
Bulletproof Hosting: A Backbone of Cybercrime
Bulletproof hosting services allow cybercriminals to operate malware distribution, ransomware infrastructure, phishing links, and illicit data markets with minimal risk of takedowns. These hosts often ignore law-enforcement requests and rely on unregulated or friendly jurisdictions to stay online.
The Five Eyes alliance — involving the U.S., U.K., Australia, Canada, and New Zealand — released a mitigation guide to help organizations defend against threats supported by these services. Officials cautioned that disrupting bulletproof hosting requires a careful strategy because the malicious infrastructure often coexists with legitimate internet operations.
Infrastructure Still Active — For Now
Despite the sanctions, experts warn that Media Land’s network will not immediately disappear. Zach Edwards, senior threat analyst at Silent Push, noted that the provider’s survival depends on whether its peering partners — the networks that enable internet traffic — cut ties.
One such partner, JSC RetnNet, is based in Russia, but another, RETN Limited, is a U.K.-based ISP.
“The bulletproof hosting ecosystem is thriving and growing,” Edwards said. “We still need law enforcement to put more pressure on the peering partners who help keep this infrastructure online.”
Crackdown Expands to Aeza Group Enablers
Authorities also targeted companies and individuals accused of helping the already-sanctioned Aeza Group evade restrictions and rebuild operations under new identities.
Those sanctioned include:
- Hypercore, a U.K.-based company
- Maksim Vladimirovich Makarov, alleged new director of Aeza
- Ilya Vladislavovich Zakirov
- Smart Digital Ideas DOO
- Datavice MCHJ
These organizations are accused of providing technical services, infrastructure, and financial channels that enabled Aeza to reestablish its presence under fresh corporate fronts.
A Critical Step Against Cybercrime Infrastructure
Officials say the sanctions strike at the heart of global cybercrime by targeting the hosting providers that make large-scale digital attacks possible.
“Bulletproof hosting is one of the core enablers of modern cybercrime,” said Madhu Gottumukkala, acting director of CISA.
Experts agree that focusing on these service providers is crucial to reducing worldwide ransomware and data-extortion activity.
“Otherwise, we end up playing Whac-A-Mole with individual threat actors for years,” Edwards warned.
