US charges Russian web hosts over $62M ransomware support
US prosecutors have unsealed charges against two Russian web hosts that allegedly sheltered major ransomware networks, a development that disrupts criminal infrastructure posing risks to global digital supply chains.
US prosecutors have unsealed an indictment charging three Russian nationals with hacking, conspiracy, and money laundering. The individuals were first charged in 2024, but the indictment was only unsealed this week. Alexander Volosovik, Kirill Zatolokin, and Yulia Pankova, who reside in St. Petersburg, are accused of owning and operating two web hosting companies, Media Land and ML.Cloud.
The businesses functioned as "bulletproof" hosts, deliberately designed to shield customers from law enforcement demands and takedowns. Prosecutors allege the infrastructure was used to launch distributed denial-of-service attacks, conduct phishing campaigns, and carry out attacks on critical infrastructure in the United States.
The indictment details attacks on US businesses across more than 20 states that generated $62 million in illicit proceeds. For European markets, the unsealing of this case carries broader implications. The web hosts allegedly provided infrastructure support to ransomware gangs including LockBit, BlackSuit, and Play. Because these criminal networks operate across borders, the disruption of their technical foundations mitigates a systemic cyber risk for European businesses operating in the same digital ecosystem.
To financially isolate the network, the US Treasury previously imposed economic sanctions on Media Land and ML.Cloud. These measures bar Americans and US businesses from transacting with the Russian suspects or their companies. Because global tech and hosting supply chains are deeply interconnected, these sanctions effectively sever the accused networks from the legitimate international financial system.
Despite the charges, the immediate legal jeopardy for the suspects remains limited. The individuals are located in Russia, which routinely shields its citizens from overseas extradition requests. Arrests are only likely if the suspects travel to countries that maintain diplomatic extradition agreements with the United States.
In a statement, US Assistant Attorney General A. Tysen Duva said the actions of the web hosts "put the American public at risk," adding: "We will continue to dismantle these networks and protect our critical infrastructure from cybercriminals at home and abroad."
