US Indicts Three Russians for Operating Bulletproof Hosting Service Facilitating Cybercrime
The U.S. unsealed an indictment against three Russian nationals accused of operating Media Land and ML Cloud, a St. Petersburg-based bulletproof hosting service that provided infrastructure and technical support to cybercriminals.
Federal prosecutors have unsealed an indictment against three Russian individuals accused of operating a significant bulletproof hosting service that facilitated a wide range of cybercriminal activities. The indictment, filed in December 2024, charges Aleksandr Volosovik, Yulia Pankova, and Kirill Zatolokin with multiple offenses, including conspiracy to commit computer fraud, wire fraud, and money laundering.
Volosovik is alleged to have owned Media Land, while Pankova owned its sister company, ML Cloud. Zatolokin, according to authorities, was responsible for collecting payments and coordinating services with cybercriminal clients. These St. Petersburg-based companies allegedly provided the essential infrastructure and technical support that enabled various cybercrime groups to operate with a degree of impunity, helping them evade law enforcement detection.
The indictment details the impact of the service, citing 44 unnamed victims who collectively suffered $62 million in losses due to cybercriminal groups that utilized Media Land and ML Cloud. Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division stated that the defendants, operating from an "overseas safe haven," ran the criminal infrastructure that powered attacks on critical institutions across the United States, thereby putting the American public at risk.
Authorities revealed that ransomware groups such as Lockbit, BlackSuit, and Play were among the clients of Media Land and ML Cloud. Additionally, cybercrime marketplaces specializing in stolen credit card information, including Briansclub, Cardhouse, crdclub, Club2crd, Verified, Fullzinfo, Swipestore, and Bidencash, also leveraged Media Land's infrastructure. The U.S. government has announced a reward of up to $10 million for information related to foreign government links to the activities of these companies.
This action is part of a broader international effort to disrupt cybercrime. Agencies from the United Kingdom, Australia, and the Netherlands assisted in the investigation. Paul Foster, director of the U.K.'s National Cyber Crime Unit, emphasized the strength of international collaboration in bringing cybercriminals to justice. The indictment highlights the persistent challenge posed by bulletproof hosting services, which are crucial enablers for many financially motivated cyberattacks.
While the indicted individuals are known residents of St. Petersburg, Russia, and the U.S. does not have an extradition treaty with Russia, the unsealing of the indictment and the substantial reward offer signal the U.S. government's commitment to pursuing those who facilitate cybercrime, regardless of their location. The investigation and subsequent charges aim to dismantle the operational capabilities of such services and deter others from engaging in similar activities.
The disruption of bulletproof hosting providers like Media Land and ML Cloud is a critical component in the global fight against cybercrime. By targeting the infrastructure that underpins these criminal operations, law enforcement agencies aim to increase the cost and difficulty for cybercriminals to conduct their attacks, ultimately protecting businesses and individuals from financial and data loss.