A major ransomware hosting provider just got hit US with sanctions

The US Treasury has announced sanctions against Russian bulletproof hosting (BPH) provider Aeza Group for its support for cyber criminals in the US and around the world.

According to US officials, the group has been selling access to specialized servers and other computer infrastructure running ransomware campaigns, infostealer operations, dark web drug markets, and Russian disinformation campaigns.

“Cyber criminals continue to rely heavily on BPH service providers like Aeza Group to facilitate disruptive ransomware attacks, steal US technology, and sell black-market drugs,” said Bradley Smith, acting under secretary of the Treasury for terrorism and financial intelligence.

30% off Keeper Security's Business Starter and Business plans

<p>Keeper Security is trusted and valued by thousands of businesses and millions of employees. Why not join them and protect your most important assets while taking advantage of this special offer?

ITpro Approved Sponsored DealView Deal

“Treasury, in close coordination with the UK and our other international partners, remains resolved to expose the critical nodes, infrastructure, and individuals that underpin this criminal ecosystem.”

Headquartered in St. Petersburg, Aeza Group has provided its BPH services to ransomware and malware groups including Medusa and Lumma, along with infostealer operators that have used the hosting service to target the US defense industrial base and technology companies.

It has also hosted BianLian ransomware, RedLine infostealer panels, and BlackSprut, a Russian dark web marketplace for illicit drugs.

The sanctions include two affiliated companies - Aeza Logistic and Cloud Solutions - as well as the UK-based front company for Aeza Group, Aeza International Limited.

Sanctions hit individuals linked to Aeza Group

The sanctions also apply to four key personnel: Arsenii Aleksandrovich Penzev, Yurii Meruzhanovich Bozoyan, Vladimir Vyacheslavovich Gast, and Igor Anatolyevich Knyazev.

All property and interests in property of the four in the US, or in the possession or control of US persons, are blocked and must be reported to the Office of Foreign Assets Control (OFAC).

Meanwhile, any entities that are owned 50% or more by one or more blocked persons are also blocked.

Ronen Ahdut, head of Cyops at Cynet, said the sanctions imposed on the hosting service mark a “strategic shift in cyber crime disruption” and could play a crucial role in disrupting ransomware operations.

"Bulletproof hosts like Aeza offer anonymous, no-logs servers paid via crypto, making them ideal for persistent malicious activity,” Ahdut said.

However, he warned that network-based indicators of compromise (IOCs) such as IPs and domains are highly dynamic and often short-lived, making traditional defenses insufficient in the long term.

"While this takedown is a tactical win, it’s only a temporary disruption in a vast, decentralized ecosystem where threat actors quickly adapt," he said.

Earlier this year, international authorities announced that they'd taken down another BPH service, Zservers, which they said had been playing a critical role in the infrastructure of major cyber criminal groups such as LockBit and BlackCat.

Based in the small Russian town of Barnaul in Western Siberia, the organization was said to have been in operation since 2011, offering a variety of illicit hosting services for brute-forcing and vulnerability scanning on cyber crime forums.

MORE FROM ITPRO

• Building ransomware resilience to avoid paying out
• The new ransomware groups worrying security researchers in 2025
• Ransomware missteps that can cost you