U.S. indicts Russian hosting operators over $62 million in cyber losses

Federal prosecutors in the Northern District of Ohio unsealed an indictment on July 15 charging three Russian nationals and two related “bulletproof hosting” companies with helping run the infrastructure behind cyberattacks that caused more than $62 million in losses to U.S. victims. The case reached victims in 21 states and several countries.

The indictment names Alexander Volosovik, Kirill Zatolokin and Yulia Pankova. It also names Media Land, LLC and ML.Cloud, both based in St. Petersburg, Russia. The companies operated as bulletproof hosts, a kind of web infrastructure built to shield criminal customers from abuse complaints and law enforcement pressure that would force ordinary providers to shut them down.

The investigation targeted the middle layer that keeps cybercrime online: servers, domains and payment-friendly hosting that allow ransomware crews and phishing operators to keep relaunching after takedowns. The probe lasted seven years and was led by the FBI’s Cleveland Division, with help from the Cybersecurity and Infrastructure Security Agency and the Office of Foreign Assets Control, plus law enforcement partners in Australia, Britain and the Netherlands.

Treasury previously identified Media Land as a key launchpad for ransomware and as providing bulletproof hosting services to criminal marketplaces and ransomware actors including LockBit, BlackSuit and Play. Treasury also sanctioned Media Land’s subsidiaries Media Land Technology, or MLT, and Data Center Kirishi, or DC Kirishi, along with ML.Cloud. Court documents show Media Land was owned by Volosovik and ML.Cloud by Pankova.

The State Department’s Rewards for Justice program offers a reward of up to $10 million for actionable information on foreign government-linked associates of Pankova, Volosovik and Zatolokin, their malicious cyber activities, or foreign government-linked use of Media Land or ML.Cloud.