Coordinated sanctions hit Russian bulletproof hosting providers enabling top ransomware Ops

US, Australia and the United Kingdom sanctioned two Russia-based bulletproof hosting providers accused of aiding groups such as LockBit, BlackSuit and Play. Media Land, a St. Petersburg–based BPH service provider, and its sister firm ML Cloud were designated along with their leaders for supplying infrastructure that enabled ransomware operations and other cybercrime, including DDoS attacks on U.S. entities.

According to OFAC’s announcement, the sanctions target Media Land, ML Cloud, their leaders and associates, with individuals such as Aleksandr Volosovik (Yalishanda) and Kirill Zatolokin named for providing servers, payments and coordination. The actions also sanction subsidiaries Media Land Technology and Data Center Kirishi, and designate Yulia Pankova for assisting Volosovik financially and legally.

OFAC notes that this follows a July 2025 sanctioning of Aeza Group, which it says subsequently rebranded, and records further measures including Hypercore Ltd. being designated for acting on Aeza’s behalf, with Maksim Makarov and Ilya Zakirov singled out for evasion and front-creation activities.