Unsealed DoJ Indictment Targets Bulletproof Hosting Services

The U.S. government has unveiled charges against three Russian nationals and two bulletproof hosting companies, Media Land LLC and ML.Cloud LLC. The unsealed indictment comes after the U.S. slapped sanctions on both these same individuals and companies in November 2025.

Media Land and ML.Cloud offer bulletproof hosting services that help keep threat actors and their infrastructure, like IP addresses or domains, hidden from law enforcement and regulatory enforcement attempts. These services also facilitate cybercrime by providing capabilities to register private domains and offering fast-flux services, which make tracing IP addresses difficult. Media Land, which hosts operations out of St. Petersburg, Russia, has been used by ransomware groups like Lockbit, Blacksuit, and Play. 

The indicted individuals are allegedly associated with both Media Land and ML.Cloud in some capacity. The DoJ claims that:

• Alexander Alexandrovich Volosovik, 43, is a general director of Media Land, and has advertised the company on cybercriminal forums, along with conducting troubleshooting for ransomware and DDoS actors
• Kirill Andreevich Zatolokin, 34, is a Media Land employee who collects customer payments and coordinates with other cyber actors 
• Yulia Vladimirovna Pankova, 29, is a founder of the affiliated ML.Cloud entity, which has been used to process payments for fast-flux servers

 “From their overseas haven, these defendants ran the criminal infrastructure that powered attacks on critical institutions across our nation,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division in a Tuesday post. “Their actions put the American public at risk. We will continue to dismantle these networks and protect our critical infrastructure from cybercriminals at home and abroad.”

In a move that puts further pressure on the cybercriminals, the State Department also announced rewards of up to $10 million (and the potential for relocation) for “actionable” information about foreign government-linked associates of Pankova, Volosovik and Zatolokin. 

Media Land and ML.Cloud have also supported other cybercriminal marketplaces and provided a platform from which cybercriminals could launch phishing and brute-force attacks. According to the indictment, 42 victims in 21 states were targeted by criminal groups who used Media Land’s and ML.Cloud’s services.

The DoJ said that this latest announcement is part of the ongoing Operation Riptide campaign, which is an FBI initiative announced in June that targets not just cybercriminal actors, but also the web of infrastructure and financial networks facilitating the cybercriminal ecosystem as a whole. Other cybercrime disruption efforts tied to this operation include First VPN Service, a service used by ransomware actors.