Key facts
- Three Russian nationals and two web hosts have been charged by U.S. prosecutors.
- The charges include hacking, conspiracy, and money laundering.
- The alleged cyberattacks caused tens of millions of dollars in damages to U.S. businesses.
- The web hosts, Media Land and ML.Cloud, allegedly provided infrastructure for cybercriminals.
- Hackers used the services to launch DDoS and phishing attacks, netting $62 million.
- The U.S. Treasury had previously sanctioned the companies for supporting ransomware gangs.
U.S. prosecutors have charged three Russian nationals and two web hosting companies with conspiracy, hacking, and money laundering for allegedly providing infrastructure for cyberattacks that caused tens of millions of dollars in damages to American businesses.
Alexander Volosovik, Kirill Zatolokin, and Yulia Pankova, all residing in St. Petersburg, are accused of owning and operating web hosts Media Land and ML.Cloud. These companies allegedly offered web hosting and infrastructure support to criminals and state-backed hackers for carrying out cyberattacks.
The indictment, first filed in 2024, was unsealed this week. The U.S. Treasury had previously sanctioned Medialand and ML.Cloud for enabling ransomware gangs such as LockBit, BlackSuit, and Play to use their services. These sanctions prohibit Americans and U.S. businesses from engaging in transactions with the charged individuals or their companies.
Prosecutors stated that hackers utilized the web hosts to execute distributed denial-of-service attacks, aimed at disrupting websites and services, as well as to conduct phishing attacks and target critical infrastructure within the United States. The companies were used to launch attacks against dozens of U.S. businesses in over 20 states, resulting in approximately $62 million in illicit proceeds.
The Justice Department noted that by offering their services as a "bulletproof" web host, the companies deliberately sought to shield their clients from law enforcement investigations and takedowns. Given the suspects' location in Russia, where extradition to the U.S. is rare, their capture is considered unlikely, although law enforcement has previously apprehended high-value suspects traveling to countries with extradition agreements with the U.S.
U.S. Assistant Attorney General A. Tysen Duva commented that the web hosts' actions "put the American public at risk" and vowed to continue dismantling such networks to protect critical infrastructure from cybercriminals.