A major ransomware hosting provider just got hit US with sanctions
Aeza Group's services were being used for ransomware, infostealers, and disinformation
The US Treasury has announced sanctions against Russian bulletproof hosting (BPH) provider Aeza Group for its support for cyber criminals in the US and around the world.
According to US officials, the group has been selling access to specialized servers and other computer infrastructure running ransomware campaigns, infostealer operations, dark web drug markets, and Russian disinformation campaigns.
“Cyber criminals continue to rely heavily on BPH service providers like Aeza Group to facilitate disruptive ransomware attacks, steal US technology, and sell black-market drugs,” said Bradley Smith, acting under secretary of the Treasury for terrorism and financial intelligence.
“Treasury, in close coordination with the UK and our other international partners, remains resolved to expose the critical nodes, infrastructure, and individuals that underpin this criminal ecosystem.”
Headquartered in St. Petersburg, Aeza Group has provided its BPH services to ransomware and malware groups including Medusa and Lumma, along with infostealer operators that have used the hosting service to target the US defense industrial base and technology companies.
It has also hosted BianLian ransomware, RedLine infostealer panels, and BlackSprut, a Russian dark web marketplace for illicit drugs.
The sanctions include two affiliated companies - Aeza Logistic and Cloud Solutions - as well as the UK-based front company for Aeza Group, Aeza International Limited.
Sanctions hit individuals linked to Aeza Group
The sanctions also apply to four key personnel: Arsenii Aleksandrovich Penzev, Yurii Meruzhanovich Bozoyan, Vladimir Vyacheslavovich Gast, and Igor Anatolyevich Knyazev.
All property and interests in property of the four in the US, or in the possession or control of US persons, are blocked and must be reported to the Office of Foreign Assets Control (OFAC).
Meanwhile, any entities that are owned 50% or more by one or more blocked persons are also blocked.
Ronen Ahdut, head of Cyops at Cynet, said the sanctions imposed on the hosting service mark a “strategic shift in cyber crime disruption” and could play a crucial role in disrupting ransomware operations.
"Bulletproof hosts like Aeza offer anonymous, no-logs servers paid via crypto, making them ideal for persistent malicious activity,” Ahdut said.
However, he warned that network-based indicators of compromise (IOCs) such as IPs and domains are highly dynamic and often short-lived, making traditional defenses insufficient in the long term.
"While this takedown is a tactical win, it’s only a temporary disruption in a vast, decentralized ecosystem where threat actors quickly adapt," he said.
Earlier this year, international authorities announced that they'd taken down another BPH service, Zservers, which they said had been playing a critical role in the infrastructure of major cyber criminal groups such as LockBit and BlackCat.
Based in the small Russian town of Barnaul in Western Siberia, the organization was said to have been in operation since 2011, offering a variety of illicit hosting services for brute-forcing and vulnerability scanning on cyber crime forums.
MORE FROM ITPRO
-
Microsoft Copilot bug saw AI snoop on confidential emails — after it was told not toNews The Copilot bug meant an AI summarizing tool accessed messages in the Sent and Draft folders, dodging policy rules
-
Cyber experts issue warning over new phishing kit that proxies real login pagesNews The Starkiller package offers monthly framework updates and documentation, meaning no technical ability is needed
-
Using AI to generate passwords is a terrible idea, experts warnNews Researchers have warned the use of AI-generated passwords puts users and businesses at risk
-
Researchers called on LastPass, Dashlane, and Bitwarden to up defenses after severe flaws put 60 million users at risk – here’s how each company respondedNews Analysts at ETH Zurich called for cryptographic standard improvements after a host of password managers were found lacking
-
‘They are able to move fast now’: AI is expanding attack surfaces – and hackers are looking to reap the same rewards as enterprises with the technologyNews Potent new malware strains, faster attack times, and the rise of shadow AI are causing havoc
-
Ransomware gangs are using employee monitoring software as a springboard for cyber attacksNews Two attempted attacks aimed to exploit Net Monitor for Employees Professional and SimpleHelp
-
Notepad++ hackers remained undetected and pushed malicious updates for six months – here’s who’s responsible, how they did it, and how to check if you’ve been affectedNews Hackers remained undetected for months and distributed malicious updates to Notepad++ users after breaching the text editor software – here's how to check if you've been affected.
-
CISA’s interim chief uploaded sensitive documents to a public version of ChatGPT – security experts explain why you should never do thatNews The incident at CISA raises yet more concerns about the rise of ‘shadow AI’ and data protection risks
-
Former Google engineer convicted of economic espionage after stealing thousands of secret AI, supercomputing documentsNews Linwei Ding told Chinese investors he could build a world-class supercomputer
-
90% of companies are woefully unprepared for quantum security threats – analysts say they need to get a move onNews Quantum security threats are coming, but a Bain & Company survey shows systems aren't yet in place to prevent widespread chaos
