Federal prosecutors on Tuesday unsealed an indictment against three Russian nationals accused of operating a bulletproof hosting service that allegedly supplied infrastructure and technical support to some of the world’s most active cybercriminal groups. The U.S. State Department simultaneously announced a reward of up to $10 million for information leading to the defendants’ capture or conviction.
The defendants, Aleksandr Volosovik (known online as “Yalishanda”), Yulia Pankova, and Kirill Zatolokin, are all believed to reside in St. Petersburg, Russia. According to prosecutors, Volosovik owned the hosting business Media Land, while Pankova owned a sister company, ML Cloud. Zatolokin allegedly handled payment collection and coordinated services between the companies and their cybercriminal clientele.
The indictment, filed in December 2024 and unsealed this week, charges all three with conspiracy to commit and aid computer fraud, conspiracy to commit wire fraud, wire fraud, and conspiracy to commit money laundering. Bulletproof hosting providers are designed to shield criminal infrastructure from law enforcement takedown efforts, typically by ignoring abuse complaints and operating outside jurisdictions with strong cooperation agreements with Western authorities.
Court documents cite 44 unnamed victims who suffered a combined $62 million in losses tied to cybercriminal groups that relied on Media Land and ML Cloud infrastructure. Ransomware operations including Lockbit, BlackSuit, and Play were among the groups named as customers, according to authorities. Several carding marketplaces specializing in stolen credit card data, including Briansclub, Cardhouse, crdclub, Club2crd, Verified, Fullzinfo, Swipestore, and Bidencash, also reportedly used Media Land infrastructure. Bidencash was dismantled in an international law enforcement operation last year.
“From their overseas safe haven, these defendants ran the criminal infrastructure that powered attacks on critical institutions across our nation,” said Assistant Attorney General A. Tysen Duva of the Justice Department’s Criminal Division.
The case follows sanctions imposed last November against Media Land, ML Cloud, and a third entity, Data Center Kirishi, which is not named in the current indictment. The U.K. and Australia joined the U.S. in the original sanctions action, and agencies from the Netherlands assisted in the broader investigation, prosecutors said.
Because Russia and the United States lack an extradition treaty, prosecution of the three defendants remains unlikely in the near term. Moscow has recently cautioned Russian nationals against traveling to countries with a history of extraditing suspects to the U.S. The Rewards for Justice bounty specifically seeks information about any foreign government links to Media Land and ML Cloud’s operations.
“This action reflects the strength of close collaboration between international partners to identify, disrupt, and bring cybercriminals to justice,” said Paul Foster, director of the U.K.’s National Cyber Crime Unit.