US Indicts Russian Web Hosts for $62M Cybercrime Operation

TL;DR

• **Unsealed Charges:** A federal indictment returned in December 2024 was unsealed this week in the Northern District of Ohio, charging three Russian nationals and two "bulletproof" web hosting companies for facilitating cyberattacks.
• **Massive Profits:** Prosecutors allege the defendants helped hackers infect victims with malware and ransomware, netting over **$62 million** in proceeds from attacks on dozens of U.S. businesses across 20 states.
• **Global Sanctions:** The U.S. Treasury sanctioned the defendants and their companies in November 2025, with the U.K. and Australia joining the measures, though extradition from Russia remains unlikely.

US Charges Russian Web Hosts Behind $62M Cybercrime Ring

The United States Department of Justice has unsealed a significant indictment against three Russian nationals and two web hosting companies accused of operating a "bulletproof" infrastructure that enabled a global cybercrime operation. The charges allege that Alexander Volosovik, Kirill Zatolokin, and Yulia Pankova, all residents of St. Petersburg, Russia, owned and operated Medialand LLC and ML.Cloud, providing the critical server infrastructure used to launch ransomware, phishing, and distributed denial-of-service (DDoS) attacks against U.S. targets.

The "Bulletproof" Hosting Allegation

The core of the prosecution's argument rests on the defendants' role as "bulletproof" hosting providers. According to Justice Department statements, these companies deliberately marketed their services to shield criminal clients from law enforcement demands and takedowns, effectively acting as a shield for cybercriminals. Court documents allege that Medialand and ML.Cloud provided criminal co-conspirators with the means to infect victim computers with malware and ransomware, subsequently extorting victims for money and cryptocurrency.

Prosecutors stated that hackers utilized this infrastructure to target dozens of U.S. businesses across more than 20 states. The attacks included DDoS campaigns designed to knock websites offline, phishing operations to steal credentials, and direct cyberattacks on critical infrastructure. By offering these services, the companies allegedly facilitated the infection of thousands of IP addresses controlled by some of the planet's most vicious ransomware gangs.

$62 Million in Proceeds and Ransomware Gangs

The financial scale of the operation is described as massive. Federal prosecutors say the cyberattacks facilitated by the Russian hosts netted approximately $62 million in proceeds from victims. The indictment specifically notes that the infrastructure was used by notorious ransomware gangs, including LockBit, BlackSuit, and Play, to carry out their extortion campaigns.

The indictment, which was originally returned by a federal grand jury in December 2024, charges the defendants with conspiracy to commit and aid and abet computer fraud, conspiracy to commit wire fraud, wire fraud, and conspiracy to commit money laundering. The U.S. Department of State's Rewards for Justice program has subsequently announced a reward of up to $10 million for information leading to the arrest or conviction of the indicted defendants.

Sanctions and the Reality of Extradition

In a coordinated move preceding the unsealing of the indictment, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) announced sanctions against the three individuals and their companies in November 2025. These sanctions block all U.S. property of the defendants and prohibit transactions by U.S. persons. The United Kingdom’s Foreign Commonwealth and Development Office joined the sanctions in full, while Australia’s Department of Foreign Affairs and Trade joined in part.

Despite the legal and financial pressure, the likelihood of the defendants facing trial in the United States remains low. The suspects reside in St. Petersburg, and extradition of Russian nationals to the U.S. is historically rare. U.S. Assistant Attorney General A. Tysen Duva acknowledged this reality while emphasizing the government's commitment to dismantling these networks: "We will continue to dismantle these networks and protect our critical infrastructure from cybercriminals at home and abroad."

Global Implications for Cybersecurity

This case highlights the ongoing challenge of combating cybercrime that relies on infrastructure hosted in jurisdictions with limited cooperation with Western law enforcement. The "bulletproof" hosting model allows criminal organizations to operate with a degree of impunity, as the hosting providers explicitly refuse to comply with takedown requests from authorities.

The unsealing of this indictment serves as a warning to other infrastructure providers that knowingly facilitating cyberattacks on U.S. critical infrastructure will result in severe federal charges and international sanctions. While the physical capture of Volosovik, Zatolokin, and Pankova may be improbable, the unsealing of the charges and the imposition of sanctions aim to disrupt the financial ecosystems that support these global ransomware operations.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.