UK targets ‘bulletproof’ services that hosted ransomware gangs

The UK’s National Crime Agency and partners from the Anglophone Five Eyes intelligence alliance have fired several shots across the bows of so-called ‘bulletproof’ hosting services Media Land and ML Cloud that shielded their customers, including ransomware gangs such as Black Basta, Evil Corp and LockBit, from detection.

The two organisations are alleged to be part of a Russia-based operation run by an individual named as Alexander Volosovik (aka Yalishanda), who is described as a “critical enabler” of global cyber crime.

They are accused of supporting large-scale ransomware campaigns and other malware operations, leading to financial losses, operational disruption and reputational damage for ordinary businesses all over the world.

The NCA said the actions complemented its strategy of targeting the ransomware ecosystem’s key enablers who facilitate criminal activity and lower the barrier to entry for cyber criminals.

“Bulletproof hosting is a key component of the cyber crime ecosystem, providing a digital safe haven  for cyber criminals that can appear resistant to law enforcement takedown activity,” said NCA deputy director Paul Foster, head of the National Cyber Crime Unit.

“Services like Media Land … are critical enablers for cyber criminals so sanctions like today's against Media Land will inhibit their ability to plan, launch and monetise criminal schemes.

“This action will assist in law enforcement's pursuit of nullifying the 'bulletproof' shield provided by illicit hosting services, helping to degrade the cybercrime ecosystem that nefarious actors depend on.”

Volosovik and two associates have been sanctioned by the Foreign, Commonwealth and Development Office (FCDO) in the UK, the US Department of the Treasury’s Office of Foreign Assets Control (OFAC), and Australia’s Department for Foreign Affairs and Trade (DFAT).

The other two individuals were named by the US as Kirill Zatolokin, who was allegedly responsible for collecting payments and liaising with other cyber criminals, and Yulia Pankova, who allegedly provided legal and financial support to the operation.

“These so-called bulletproof hosting service providers like Media Land provide cybercriminals essential services to aid them in attacking businesses in the United States and in allied countries,” said John Hurley, under secretary of the Treasury for Terrorism and Financial Intelligence.

“Today’s trilateral action with Australia and the UK, in coordination with law enforcement partners, demonstrates our collective commitment to combatting cyber crime and protecting our citizens.”