The US government has taken a significant step in its ongoing fight against cybercrime, charging three Russian nationals with operating a bulletproof hosting (BPH) service that provided infrastructure to ransomware gangs responsible for over $62 million in damages worldwide. The indictment unsealed on Tuesday targets Aleksandr Volosovik, Yulia Pankova, and Kirill Zatolokin, who allegedly owned or worked for Media Land and ML.Cloud, two BPH services that marketed themselves as “bulletproof” by ignoring victims’ complaints and law enforcement takedown requests.
Bulletproof hosting providers lease servers to help malicious actors evade disruption efforts. They offer a range of services, including malware delivery, command-and-control operations, phishing attacks, and illicit content hosting. These services are often used by ransomware gangs to launch devastating attacks on organizations around the world. In this case, the US Department of State is offering a reward of up to $10 million through its Rewards for Justice program for any information that can help bring these individuals to justice.
Media Land and ML.Cloud allegedly provided infrastructure in multiple countries outside Russia, including China, Finland, the Netherlands, and the United States. The indictment suggests that Volosovik owned Media Land, while Pankova was involved in the company’s legal and financial matters. Zatolokin is accused of collecting customer payments. The US government has previously sanctioned these individuals and companies for their involvement in providing attack infrastructure to multiple ransomware and cybercrime operations.
The impact of this case is significant. The victims of these attacks are not just limited to one country or industry; they span across 20 states in the US, affecting banks, schools, government entities, hospitals, and media companies. As United States Attorney David M. Toepfer noted, “Together with our international partners, we will aggressively combat the efforts of individuals who hide behind computers anywhere in the world who seek to profit and wreak havoc by targeting the infrastructures that support our communities.”
The European Union has also taken action against these individuals and companies. The Council of the European Union announced sanctions against Media Land, ML.Cloud, and Volosovik as part of a joint cyber sanctions package with the UK.
What does this mean for security teams and organizations? It’s essential to remember that bulletproof hosting providers often operate in the shadows, making it challenging for law enforcement to track them down. However, by working together with international partners, governments can disrupt these operations and bring those responsible to justice.
In light of this case, it’s crucial for organizations to remain vigilant when it comes to online security. Regularly testing your security systems and implementing robust threat detection capabilities can help prevent attacks from slipping through the cracks. By staying one step ahead of attackers, you can protect your organization from devastating cyberattacks.
Source: Bleeping Computer — 2026-07-15