U.S., U.K. and Australia sanction Russian host Media Land over ransomware support
The United States, the United Kingdom and Australia imposed coordinated sanctions on Nov. 19 against Media Land, a bulletproof hosting provider based in St. Petersburg, Russia, along with its general director and several related people and companies.
Bulletproof hosts rent servers to criminals and ignore abuse complaints and police requests. The designations target the infrastructure that lets ransomware groups run leak sites, command servers and data-theft operations, rather than the gangs themselves.
Who was sanctioned
According to Security Affairs and blockchain analytics firm Elliptic, the U.S. Treasury's Office of Foreign Assets Control designated Media Land; its sister company ML Cloud; its subsidiaries Media Land Technology and Data Center Kirishi; general director Aleksandr Volosovik, known online as "Yalishanda"; employee Kirill Zatolokin, who allegedly handled payments; and Yulia Pankova, who allegedly helped Volosovik financially and legally. The U.K. designated the same people and entities that day.
U.S. officials said Media Land's infrastructure supported the LockBit, BlackSuit and Play ransomware operations, as well as distributed denial-of-service attacks on U.S. companies. Elliptic noted that public research has also linked the provider to Snatch, GandCrab, Smokeloader and phishing campaigns.
Follow-up on Aeza Group
The same action extended earlier sanctions on Aeza Group, a Russian host designated in July 2025. Officials said Aeza tried to evade those measures by shifting its IP infrastructure to a U.K. company, Hypercore Ltd., which was designated. Aeza's new director, Maksim Makarov, and Ilya Zakirov, who allegedly set up front companies and payment channels, were also named, along with Smart Digital Ideas in Serbia and Datavice in Uzbekistan.
OFAC also listed a Bitcoin address tied to Volosovik. Elliptic said the address and related addresses received only small amounts and were last active in November 2024.
Guidance for network operators
Alongside the sanctions, Five Eyes cybersecurity agencies and the Netherlands released guidance on reducing risk from bulletproof hosting providers. It urges internet service providers and defenders to block known malicious network ranges, keep curated high-confidence blocklists, analyze traffic and share intelligence with peers.
Canada was not among the three sanctioning governments named in the reporting. Sanctions mean U.S., U.K. and Australian persons cannot deal with the listed parties, which can make it harder for them to buy hardware, rent data-centre space or move money through Western systems.
What to do
- Network teams can check firewall and proxy logs for traffic to address ranges associated with the sanctioned providers.
- Organizations that buy hosting or IP space should confirm their suppliers are not on sanctions lists.
