US DOJ charges Russians over bulletproof hosting

Update, August 20, 2026: recent coverage expanded the DOJ indictment, also linking it to Cl0p and at least 13 other criminal groups. New reporting on the case also describes the charges as a mix of cybercrime and financial crime, with allegations of conspiracy and money laundering.

Federal prosecutors in the United States have charged three Russian citizens and two web hosting operators over their alleged ties to ransomware campaigns supported by bulletproof hosting infrastructure. According to the indictment, the companies involved provided hosting and technical support for operations that hit U.S. companies and private-sector entities in the country.

Whom did the Department of Justice name?

The Department of Justice identified the three Russian citizens as Alexander Alexandrovich Volosovik, 43, Kirill Andreevich Zatolokin, 34, and Yulia Vladimirovna Pankova, 29. All three were linked to Media Land LLC and ML.Cloud LLC, companies based in St. Petersburg.

The indictment says Media Land and ML.Cloud provided bulletproof hosting infrastructure for years to ransomware operations associated with LockBit, BlackSuit and Play. Later reporting added that the same infrastructure may also have supported Cl0p and at least 13 more cybercriminal groups, broadening the scope attributed to the Russian scheme.

How much damage is attributed?

According to the reporting summary of the indictment, U.S. authorities estimate economic losses of about $57 million to $62 million tied to these campaigns. The court filing, according to documents cited by specialized media, lists 42 victims across 21 U.S. states, including banks, hospitals, schools and local governments.

That web of victims, according to the cited documents, also reached U.S. companies and other private-sector entities. The hosting infrastructure described in the indictment allegedly helped sustain the criminal campaigns and made them harder to disrupt.

What charges and penalties do they face?

On the criminal side, the three defendants face charges of conspiracy to commit and facilitate computer fraud, conspiracy to commit wire fraud, wire fraud, and conspiracy to launder money. Other references to the case summarize the indictment as charges for cyberattacks, conspiracy and money laundering, in a framing that combines cybercrime and financial crime.

The DOJ action was also coordinated with OFAC financial sanctions in a trilateral framework involving the United States, the United Kingdom and Australia, aimed at both the accused individuals and Media Land and ML.Cloud.

Russian local media noted that the U.S. Department of Justice reminded readers in its statement that an indictment is only an allegation, and that all people and companies named are presumed innocent until proven guilty in a U.S. court.