U.S. Charges Three Russians Accused of Supporting Ransomware Gangs Through Hosting Services
Summary
U.S. prosecutors charged three Russian nationals accused of operating Media Land and ML.Cloud, hosting services allegedly used by ransomware groups and linked to more than $62 million in damage. Multiple governments have imposed sanctions.
Key points
- U.S. federal prosecutors unsealed charges against Aleksandr Volosovik, Yulia Pankova, and Kirill Zatolokin over their alleged roles in Media Land and ML.Cloud.
- Prosecutors accuse the services of providing infrastructure for malware delivery, command-and-control, phishing, and illicit hosting.
- The services allegedly supported operations involving LockBit, BlackSuit, and Play; prosecutors cite more than $62 million in damage worldwide.
- The article says the services operated infrastructure in several countries, including the United States, China, Finland, and the Netherlands.
- The U.S., U.K., and Australia previously sanctioned the defendants and related companies; the EU also announced sanctions against Media Land, ML.Cloud, and Volosovik.
- The U.S. State Department is offering up to $10 million for information about foreign government-linked associates or activities related to the operators and companies.
Article Details
- Event Type
- U.S. federal prosecutors unsealed charges against three Russian nationals accused of operating bulletproof hosting services that supported ransomware and cybercrime operations.
- Impact
- Prosecutors allege the activity caused more than $62 million in damage worldwide. Authorities said Media Land infrastructure was used for DDoS attacks against U.S. companies and critical infrastructure; reported victims included banks, schools, government entities, hospitals, and media companies.
MITRE ATT&CK
People
Threat Actors
Aleksandr VolosovikCharged by U.S. prosecutors and accused of owning Media Land, a bulletproof hosting service alleged to have provided infrastructure to ransomware and cybercrime operations.BlacksuitNamed as a ransomware group whose operations were allegedly supported by infrastructure provided by Media Land and ML.Cloud.Kirill ZatolokinCharged by U.S. prosecutors and accused of collecting customer payments for the alleged bulletproof hosting operation.LockBitNamed as a ransomware group whose operations were allegedly supported by infrastructure provided by Media Land and ML.Cloud.PlayNamed as a ransomware group whose operations were allegedly supported by infrastructure provided by Media Land and ML.Cloud.YalishandaAlias Aleksandr Volosovik reportedly used on cybercriminal forums; Volosovik was charged and accused of owning Media Land.Yulia PankovaCharged by U.S. prosecutors and accused of owning ML.Cloud and assisting with its legal and financial matters.
Vendors
Media LandMedia Land and ML.Cloud allegedly provided attack infrastructure to groups including LockBit, BlackSuit, and Play, while the U.S., U.K., EU, and Australia have also imposed sanctions and the State Department is offeringML.CloudMedia Land and ML.Cloud allegedly provided attack infrastructure to groups including LockBit, BlackSuit, and Play, while the U.S., U.K., EU, and Australia have also imposed sanctions and the State Department is offering
Countries
Australiaattack infrastructure to groups including LockBit, BlackSuit, and Play, while the U.S., U.K., EU, and Australia have also imposed sanctions and the State Department is offering a reward for information.ChinaMedia Land and ML.Cloud operated infrastructure across several countries, including the U.S., China, Finland, and the Netherlands.FinlandMedia Land and ML.Cloud operated infrastructure across several countries, including the U.S., China, Finland, and the Netherlands.NetherlandsMedia Land and ML.Cloud operated infrastructure across several countries, including the U.S., China, Finland, and the Netherlands.RussiaThe two BPH services, Media Land and ML.Cloud, also provided customers with infrastructure in multiple countries outside Russia, including China, Finland, the Netherlands, as well as the United States.United KingdomThe United States, the United Kingdom, and Australia previously sanctioned the three defendants and two companies in November for providing attack infrastructure and tech support to multiple ransomware and cybercrimeUnited StatesU.S. federal prosecutors have unsealed charges against three Russian nationals accused of running bulletproof hosting services that supported ransomware gangs and caused more than $62 million in damage worldwide.
Industries
Critical infrastructurecompanies and critical infrastructure, including telecommunications systems.Governmentof up to $10 million through its Rewards for Justice (RFJ) program for any information “on foreign government-linked associates of these actors, their malicious cyber activities, or foreign government-linked useMediaMedia Land and ML.Cloud allegedly provided attack infrastructure to groups including LockBit, BlackSuit, and Play, while the U.S., U.K., EU, and Australia have also imposed sanctions and the State Department is offeringTelecommunicationscompanies and critical infrastructure, including telecommunications systems.