U.S. Charges Three Russian Nationals Over International Cyberattacks Costing Victims More Than $62 Million

U.S. federal prosecutors have unsealed a sweeping indictment charging three Russian nationals and two St. Petersburg–based companies for operating a global “bulletproof hosting” infrastructure.

That enabled widespread cyberattacks against critical sectors, causing losses exceeding $62 million across at least 21 U.S. states and multiple countries.

The defendants Alexander Alexandrovich Volosovik, 43, Kirill Andreevich Zatolokin, 34, and Yulia Vladimirovna Pankova, 29 along with Media Land, LLC and ML.Cloud, LLC, are accused of conspiring to commit computer fraud, wire fraud, and money laundering following a seven-year FBI-led investigation.

Court documents describe Media Land and ML.Cloud as core enables of ransomware operations, malware distribution, phishing campaigns, brute-force attacks, and fraudulent online marketplaces.

Their infrastructure spanned multiple jurisdictions including China, Finland, the Netherlands, and the United States complicating attribution and takedown efforts.

Investigators allege the platforms offered technical support and operational stability to criminal affiliates, allowing them to deploy payloads, maintain persistence, and extort victims via cryptocurrency payments.

Victimology underscores the scale and indiscriminate nature of the operation. Impacted entities include banks, hospitals, schools, government agencies, and media organizations, with confirmed victims across Ohio and states such as California, Texas, New York, Florida, and Virginia.

According to the U.S. Attorney’s Office for the Northern District of Ohio, the infrastructure they operated provided resilient, anonymized hosting services deliberately designed to evade law enforcement scrutiny while supporting large-scale cybercrime campaigns.

Internationally, organizations in the European Union, United Kingdom, Canada, Australia, and the United Arab Emirates were also targeted, reflecting the transnational reach typical of bulletproof hosting ecosystems.

U.S. Charges Three Russian Nationals

The U.S. Department of State has simultaneously activated its Rewards for Justice (RFJ) program, offering up to $10 million for actionable intelligence on the defendants, their state-linked associations, or the use of Media Land and ML.Cloud in malicious cyber operations.

Tips can be submitted through the Tor-based reporting channel or via the official RFJ portal at https://rewardsforjustice.net/.

The reward signals a strong attribution posture and suggests potential links between the infrastructure and foreign government–aligned activity.

This criminal case builds on prior coordinated sanctions. In November 2025, the U.S. Treasury’s Office of Foreign Assets Control (OFAC), in coordination with the United Kingdom and Australia, designated Media Land and its operators as Specially Designated Nationals, effectively blocking U.S.-based assets and prohibiting transactions.

The sanctions also extended to associated entities including Media Land Technology and Data Center Kirishi, reinforcing efforts to disrupt the broader service ecosystem.

Details of the sanctions are available via the Treasury release: https://home.treasury.gov/news/press-releases/sb0319. On July 13, 2026, the European Union introduced parallel measures, further tightening international pressure on the network.

From a tradecraft perspective, the case highlights the persistent role of bulletproof hosting providers as force multipliers in cybercrime.

These providers reduce operational risk for threat actors by insulating command-and-control infrastructure, masking attribution, and rapidly reconstituting services after disruption.

CISA has previously warned that such providers present a systemic risk to critical infrastructure and published mitigation guidance in its “Bulletproof Defense” framework (https://www.cisa.gov/resources-tools/resources/bulletproof-defense-mitigating-risks-bulletproof-hosting-providers).

Law enforcement officials emphasized that dismantling enabling infrastructure is central to degrading cybercriminal capability.

The FBI Cleveland Division, working with international partners including Europol-linked entities, the UK National Crime Agency, and Australian authorities, coordinated investigative and intelligence-sharing efforts that culminated in the indictment.

The charges remain allegations, and the defendants are presumed innocent unless proven guilty. However, the case marks a significant escalation in targeting the service layer that underpins ransomware and intrusion operations, rather than solely pursuing individual threat actors.

For defenders, it reinforces the need to track infrastructure-level indicators, hosting patterns, and cross-border service dependencies when mapping adversary activity.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide