U.S. Indicts Three Russians Accused of Running Bulletproof Hosting Providers
Summary
A 2024 federal indictment accuses three Russian nationals and Media Land and ML.Cloud of supporting cybercrime targeting critical infrastructure. Officials attribute more than $62 million in losses to the alleged activity; sanctions and a reward offer followed.
Key points
- A federal indictment unsealed in 2024 charged Alexander Volosovik, Yulia Pankova and Kirill Zatolokin with fraud and money-laundering-related offenses.
- Prosecutors allege that Media Land and ML.Cloud provided infrastructure and technical support for malware, ransomware, phishing and brute-force activity.
- Officials said investigators identified victims in 21 U.S. states and several other countries, and attributed more than $62 million in losses to the alleged activity.
- The State Department offered up to $10 million for information about government-linked associates and malicious use of the providers.
- The U.S. Treasury Department, United Kingdom and Australia imposed sanctions on the individuals and companies in November 2025.
Article Details
- Event Type
- Federal indictment of three Russian nationals over alleged bulletproof hosting support for cybercrime, followed by sanctions against the individuals and hosting providers.
- Impact
- Officials alleged that Media Land and ML.Cloud provided infrastructure and technical support for malware, ransomware, phishing, and brute-force campaigns affecting critical infrastructure in 21 U.S. states and multiple countries. Reported losses exceeded $62 million. The Treasury Department and officials from the United Kingdom and Australia imposed sanctions in November 2025; the State Department offered a reward of up to $10 million for information about government-linked associates and malicious use of the providers.
People
A. Tysen DuvaIdentified as assistant attorney general of the Justice Department’s Criminal Division; he commented on the alleged criminal infrastructure and efforts to dismantle such networks.Brett LeathermanIdentified as assistant director of the FBI Cyber Division; he described the actions against the providers as an effort to disrupt services cybercriminals rely on.
Threat Actors
Alexander Alexandrovich VolosovikMedia Land owner who was charged in the 2024 indictment. Officials alleged that he facilitated a long-running pattern of criminal activity and that Media Land supported cybercriminals; these are allegations, not established findings in the article.Kirill Andreevich ZatolokinCharged in the 2024 indictment. Officials alleged that he facilitated a long-running pattern of criminal activity alongside the hosting providers; these are allegations, not established findings in the article.Yulia Vladimirovna PankovaML.Cloud owner who was charged in the 2024 indictment. Officials alleged that she facilitated a long-running pattern of criminal activity and that ML.Cloud supported cybercriminals; these are allegations, not established findings in the article.
Vendors
Media LandThe companies Media Land and ML.Cloud are accused of providing infrastructure and technical support for malware, ransomware, phishing, and brute-force campaigns.ML.CloudThe companies Media Land and ML.Cloud are accused of providing infrastructure and technical support for malware, ransomware, phishing, and brute-force campaigns.
Countries
AustraliaThe U.S., U.K., Australia, and Treasury Department imposed sanctions and a reward was announced.CanadaAdditional victims were located in Australia, the European Union, the United Arab Emirates, Canada and the United Kingdom.United Arab EmiratesAdditional victims were located in Australia, the European Union, the United Arab Emirates, Canada and the United Kingdom.United KingdomThe Treasury Department and officials from the United Kingdom and Australia imposed sanctions on Volosovik, Zatolokin, Pankova, Media Land and ML.Cloud in November 2025.United StatesThe U.S., U.K., Australia, and Treasury Department imposed sanctions and a reward was announced.