U.S. prosecutors have indicted three Russians and two web hosts on hacking, conspiracy and money laundering charges for their alleged role in hosting a cyberattack that cost U.S. companies tens of millions of dollars.
Alexander Volosovich, Kirill Zatrokhin, and Yulia Pankova, Russian nationals living in St. Petersburg, are accused of owning and operating two web hosts, Medialand and ML.Cloud, that are suspected of providing web hosting and infrastructure support to criminals and state-sponsored hackers to carry out cyberattacks.
The Russians were first indicted in 2024, but the indictment was unsealed this week. The US Treasury previously sanctioned Medialand and ML.Cloud for allowing ransomware groups such as LockBit, BlackSuit, and Play to use their infrastructure. Economic sanctions prohibit American persons and American companies from doing business with Russian persons or their companies.
Prosecutors said the hackers used web hosts to launch distributed denial-of-service attacks aimed at taking websites and services offline, launching phishing attacks, and conducting cyberattacks on critical U.S. infrastructure.
Hackers used these companies to attack dozens of U.S. companies across more than 20 states, netting approximately $62 million in cybercrime proceeds.
According to the Department of Justice, the companies intentionally sought to protect their customers from law enforcement requests and takedowns by offering their services as “bulletproof” web hosts.
The suspected web host is unlikely to be arrested, given that the hackers are based in Russia and extradition to the United States is rare. Russia is known for protecting its citizens from extradition requests, but law enforcement has previously arrested high-profile suspects who traveled to countries that have diplomatic agreements with the United States.
U.S. Assistant Attorney General A. Theisen Duva said in a statement that the web hosts' actions “put the American people at risk,” adding: “We continue to dismantle these networks and protect our critical infrastructure from domestic and foreign cybercriminals.”
If you buy through links in our articles, we may earn a small commission. This does not affect editorial independence.