A major ransomware hosting provider just got hit US with sanctions
Aeza Group's services were being used for ransomware, infostealers, and disinformation


The US Treasury has announced sanctions against Russian bulletproof hosting (BPH) provider Aeza Group for its support for cyber criminals in the US and around the world.
According to US officials, the group has been selling access to specialized servers and other computer infrastructure running ransomware campaigns, infostealer operations, dark web drug markets, and Russian disinformation campaigns.
“Cyber criminals continue to rely heavily on BPH service providers like Aeza Group to facilitate disruptive ransomware attacks, steal US technology, and sell black-market drugs,” said Bradley Smith, acting under secretary of the Treasury for terrorism and financial intelligence.
30% off Keeper Security's Business Starter and Business plans
Keeper Security is trusted and valued by thousands of businesses and millions of employees. Why not join them and protect your most important assets while taking advantage of this special offer?
“Treasury, in close coordination with the UK and our other international partners, remains resolved to expose the critical nodes, infrastructure, and individuals that underpin this criminal ecosystem.”
Headquartered in St. Petersburg, Aeza Group has provided its BPH services to ransomware and malware groups including Medusa and Lumma, along with infostealer operators that have used the hosting service to target the US defense industrial base and technology companies.
It has also hosted BianLian ransomware, RedLine infostealer panels, and BlackSprut, a Russian dark web marketplace for illicit drugs.
The sanctions include two affiliated companies - Aeza Logistic and Cloud Solutions - as well as the UK-based front company for Aeza Group, Aeza International Limited.
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Sanctions hit individuals linked to Aeza Group
The sanctions also apply to four key personnel: Arsenii Aleksandrovich Penzev, Yurii Meruzhanovich Bozoyan, Vladimir Vyacheslavovich Gast, and Igor Anatolyevich Knyazev.
All property and interests in property of the four in the US, or in the possession or control of US persons, are blocked and must be reported to the Office of Foreign Assets Control (OFAC).
Meanwhile, any entities that are owned 50% or more by one or more blocked persons are also blocked.
Ronen Ahdut, head of Cyops at Cynet, said the sanctions imposed on the hosting service mark a “strategic shift in cyber crime disruption” and could play a crucial role in disrupting ransomware operations.
"Bulletproof hosts like Aeza offer anonymous, no-logs servers paid via crypto, making them ideal for persistent malicious activity,” Ahdut said.
However, he warned that network-based indicators of compromise (IOCs) such as IPs and domains are highly dynamic and often short-lived, making traditional defenses insufficient in the long term.
"While this takedown is a tactical win, it’s only a temporary disruption in a vast, decentralized ecosystem where threat actors quickly adapt," he said.
Earlier this year, international authorities announced that they'd taken down another BPH service, Zservers, which they said had been playing a critical role in the infrastructure of major cyber criminal groups such as LockBit and BlackCat.
Based in the small Russian town of Barnaul in Western Siberia, the organization was said to have been in operation since 2011, offering a variety of illicit hosting services for brute-forcing and vulnerability scanning on cyber crime forums.
MORE FROM ITPRO
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
Hackers are using PDFs to impersonate big brands like Microsoft and PayPal in a new threat campaign
News Hackers are increasingly using PDF attachments to impersonate major brands in phishing campaigns, according to new research from Cisco Talos.
-
TD Synnex teams up with Cordon Group to expand lifecycle services in Europe
News The new strategic partnership introduces a host of new circular IT services via the distribution giant’s Renew program
-
Hackers are using PDFs to impersonate big brands like Microsoft and PayPal in a new threat campaign
News Hackers are increasingly using PDF attachments to impersonate major brands in phishing campaigns, according to new research from Cisco Talos.
-
UK firms are 'sleepwalking' into smart building cyber threats
News The convergence of operational technology and IT systems is posing serious risks for property firms.
-
5 Steps to Prioritize Based on Risk with Snyk
-
Beyond the Vulnerability Backlog: Building Risk-Based AppSec Programs
-
Why the Fastest Technology Companies choose Snyk Cheat Sheet
-
6 steps to a stronger security posture through automation
-
IT & Security: The Critical Alliance Against Cyber Threats
Whitepaper Actionable tips for creating a unified defense
-
Device Management Is a Losing Battle
Whitepaper Discover the winning strategy to regain control