US charges Russian 'bulletproof' web hosts over $62M cyberattacks

U.S. prosecutors have charged three Russian nationals and two web hosts with hacking, conspiracy, and money laundering over their alleged roles in hosting cyberattacks that caused tens of millions of dollars in damages to U.S. businesses.

The three Russians, Alexander Volosovik, Kirill Zatolokin, and Yulia Pankova, who reside in St. Petersburg, are accused of owning and running two web hosts, Media Land and ML.Cloud, which allegedly provided criminals and state-backed hackers with web hosting and infrastructure support for carrying out cyberattacks. The Russians were first charged in 2024, but the indictment was unsealed this week.

The U.S. Treasury previously sanctioned Medialand and ML.Cloud for allowing ransomware gangs, including LockBit, BlackSuit, and Play, to use their infrastructure. Economic sanctions bar Americans and U.S.

businesses from transacting with the Russians or their companies. Prosecutors said that hackers used the web hosts to launch distributed denial-of-service attacks designed to knock websites and services offline, launch phishing attacks, and carry out cyberattacks on critical infrastructure in the United States. Hackers used the companies to launch attacks on dozens of U.S.

businesses across more than 20 states, netting some $62 million in proceeds from cybercrime. According to the Justice Department, by offering their services as a “bulletproof” web host, the companies deliberately aimed to shield their customers from law enforcement demands and takedowns. The web host suspects are unlikely to be captured, given that the hackers are located in Russia and extraditions to the U.S.

are rare. Russia is known to shield its citizens from overseas extradition requests, but law enforcement have previously arrested high-value suspects when they travel to countries with diplomatic agreements with the United States. U.S.

Assistant Attorney General A. Tysen Duva stated, “The actions of the web hosts put the American public at risk. We will continue to dismantle these networks and protect our critical infrastructure from cybercriminals at home and abroad.” The US government's actions against these Russian web hosts highlight the ongoing efforts to combat cybercrime and protect critical infrastructure.

This case demonstrates the significant financial and operational impact that 'bulletproof' web hosts can have on cybercrime operations. As the threat of cyberattacks continues to evolve, it remains to be seen how effectively law enforcement can disrupt and dismantle these networks, particularly when suspects are located in countries with limited extradition agreements. The success of these efforts will depend on continued international cooperation and the development of more effective strategies to combat cybercrime.