Crackdown on Russian ‘Bulletproof’ Web Host

The United States, United Kingdom, and Australia have jointly sanctioned a Russian “bulletproof” web hosting company, along with its affiliates, for allegedly facilitating ransomware attacks targeting U.S. infrastructure and other victims.

Sanctions Imposed on Media Land and Affiliates

The U.S. Treasury Department announced coordinated sanctions against Media Land, a web host based in Russia, and three associated companies. These sanctions also target key executives, including its general director, also known as Yalishanda, for reportedly providing servers and support to cybercriminals.

Media Land’s Role in Cybercrime

Authorities assert that cybercriminals leveraged Media Land to execute distributed denial-of-service attacks. Notorious ransomware groups, such as LockBit, BlackSuit, and Play, allegedly depended on its infrastructure. The Treasury Department stated that some Media Land employees actively collaborated with these cybercriminals.

Understanding ‘Bulletproof’ Hosting

‘Bulletproof’ providers are web hosting and cloud service companies that emphasize their resilience against law enforcement actions, such as takedowns or legal demands. Cybercriminals commonly use them to host malicious infrastructure because of this resilience.

Impact on U.S. Businesses and Allies

U.S. officials highlighted that hosting companies like Media Land furnish cybercriminals with vital resources to launch attacks against businesses in the United States and its allied nations. However, the Treasury did not disclose the specific victims of these attacks.

UK’s Action Against Hypercore and Aeza Group

The U.K.’s Foreign Office has also designated Hypercore, a U.K.-based company, as a front for Aeza Group, another bulletproof hosting provider previously sanctioned by the U.S. in July. The U.K. stated that Aeza has ties to the Social Design Agency, a Kremlin disinformation organization.

Consequences of Sanctions

Sanctioning these companies and individuals effectively prohibits citizens, residents, and those with business connections to the U.S., U.K., and Australia from engaging in transactions or business with the sanctioned entities.

CISA and NSA Guidance

The U.S. cybersecurity agency CISA and the National Security Agency published guidance on mitigating the risks associated with bulletproof hosting providers.