The Treasury Department, along with officials from the United Kingdom and Australia, imposed sanctions Wednesday against two bulletproof hosting providers and key people involved in their operations, in a globally coordinated effort aimed at thwarting the role these services have in enabling ransomware, phishing operations, and data extortion campaigns around the world.
Authorities sanctioned Media Land, three of its leaders and three affiliated companies for allegedly supporting ransomware operations and other cybercrime. The Russia-based bulletproof hosting provider has provided services to ransomware groups, including LockBit, BlackSuit and Play, officials said.
Authorities imposed sanctions on Media Land’s general director Alexsandr Volosovik, Kirill Zatolokin, Yulia Pankova and subsidiaries ML Cloud, Media Land Technology and Data Center Kirishi.
“Media Land has been impactful largely because of its longevity. Recorded Future can trace attackers using their infrastructure back to at least 2015 — 10 years of activity,” Allan Liska, threat intelligence analyst at Recorded Future, told CyberScoop.
“Targeting this kind of infrastructure can have a disruptive effect on the ransomware ecosystem,” he said. “It’s not the same as a takedown, but it makes it much more difficult for these threat actors to operate and continue to provide services.”
Cyber authorities with the Five Eyes intelligence alliance and the Netherlands also released a mitigation guide Wednesday, which offers tips to help defenders thwart cybercrime made possible by this infrastructure. Efforts to impair these services “requires a nuanced approach because bulletproof hosting infrastructure is integrated into legitimate internet infrastructure systems, and actions from internet service providers or network defenders may impact legitimate activity,” officials said in a mitigation guide released Wednesday.
Despite the sanctions, Media Land’s infrastructure will remain online until the organization’s peering partners cut off key services, said Zach Edwards, senior threat analyst at Silent Push. One of those partners, JSC RetnNet is also based in Russia, but its other peering partner, RETN Limited, is a U.K.-based ISP, he said.
“The bulletproof hosting ecosystem is thriving and growing,” Edwards said, adding “we still need law enforcement to put more pressure on the peering partners who help to get bulletproof hosting infrastructure online and accessible to the rest of the internet.”
Cybercriminals use bulletproof hosting infrastructure to obfuscate their activities, including malware delivery, phishing, and host content and services that support ransomware, data extortion and denial of service attacks, officials said.
“Bulletproof hosting is one of the core enablers of modern cybercrime,” Madhu Gottumukkala, acting director of the Cybersecurity and Infrastructure Security Agency, said in a statement.
Officials also took action against companies and individuals who helped the previously sanctioned Aeza Group evade sanctions and reconstitute operations under new infrastructure and leadership.
U.K.-based Hypercore, Maksim Vladimirovich Makarov, the new alleged director of Azea, and Ilya Vladislavovich Zakirov were targeted with sanctions for supporting Aeza Group’s ongoing activity. Officials also sanctioned Smart Digital Ideas DOO and Datavice MCHJ for providing technical infrastructure to Azea.
“Bulletproof hosting providers are hosting the majority of cybercrime infrastructure used by a wide range of global threat actors for ransomware attacks, phishing campaigns, malware delivery and everything in between,” Edwards said.
“Focusing on these malicious hosts should be a top law-enforcement priority to ensure we’re not just playing Whac-A-Mole with individual threat actors for years to come.”