Federal prosecutors unsealed an indictment this week charging three Russian nationals and two Russia-based companies with running a "bulletproof hosting" operation that powered ransomware and other attacks against U.S. critical infrastructure, causing more than $62 million in losses.

 

What happened

The U.S. Attorney's Office for the Northern District of Ohio unsealed an indictment against Alexander Alexandrovich Volosovik, 43; Kirill Andreevich Zatolokin, 34; Yulia Vladimirovna Pankova, 29; and their companies, Media Land, LLC and ML.Cloud, LLC, all based in St. Petersburg, Russia. A federal grand jury returned the indictment in December 2024, charging the defendants with conspiracy to commit and aid and abet computer fraud, conspiracy to commit wire fraud, wire fraud, and conspiracy to commit money laundering. Investigators tied the case to a seven-year investigation and found that criminal groups used the defendants' infrastructure to attack victims in 21 states and multiple countries. The U.S. Department of State's Rewards for Justice program is now offering up to $10 million and possible relocation for information on the defendants' government-linked associates or activities.

 

Going deeper

Prosecutors allege that Media Land, owned by Volosovik, and ML.Cloud, owned by Pankova, provided computer server infrastructure and related internet services, with Media Land operating across China, Finland, the Netherlands, and the United States in addition to Russia. The companies allegedly sold "bulletproof hosting" services, which let clients run criminal operations while evading law enforcement detection. According to the indictment, the two companies knowingly leased infrastructure to cybercriminals, giving them the means to infect victim computers with malware and ransomware and then extort victims for money and cryptocurrency. Investigators also linked the infrastructure to criminal marketplaces, fraudulent domain registrations, and phishing and brute-force attacks. The U.S. government announced sanctions against the defendants and companies in November 2025, ahead of this week's unsealing.

 

What was said

Assistant Attorney General A. Tysen Duva of the Justice Department's Criminal Division said, "From their overseas haven, these defendants ran the criminal infrastructure that powered attacks on critical institutions across our nation." He added, "We will continue to dismantle these networks and protect our critical infrastructure from cybercriminals at home and abroad."

U.S. Attorney David M. Toepfer for the Northern District of Ohio said the case's victims include "banks, schools, government entities, hospitals, and media companies," adding that his office will "aggressively combat the efforts of individuals who hide behind computers anywhere in the world."

FBI Cyber Division Assistant Director Brett Leatherman said the case is "another step in our broader campaign to shrink the space in which these actors can operate, forcing them to work harder, take greater risks, and lose the anonymity they depend on."

FBI Cleveland Special Agent in Charge Josh DelManzo said the case is a reminder that "criminal networks will stop at nothing to hack, attack, share, or sell your information for their own greed, gain, and profit."

 

By the numbers

  • Losses to victims exceeded $62 million.
  • Victims were located in at least 21 U.S. states, including Ohio, California, Florida, New York, Texas, and Washington state, among others.
  • International victims were located in Australia, the European Union, the United Arab Emirates, Canada, and the United Kingdom.
  • The Northern District of Ohio identified victims in nine Ohio cities: Akron, Brookfield, Canton, Cleveland, Elyria, Medina, Findlay, Solon, and Valley View.
  • The Rewards for Justice program is offering up to $10 million for information related to the case.

 

Why it matters

The case matters because it targets the infrastructure layer that ransomware and malware operators depend on, not just the individual hackers who use it. Media Land and ML.Cloud allegedly functioned as landlords for cybercrime, knowingly renting servers to attackers so they could hit banks, hospitals, schools, and government entities while hiding their tracks. Healthcare and other critical infrastructure organizations were named among the victims, which means the reach of a single hosting provider's client base can translate into breaches and ransomware incidents across unrelated organizations. By charging the hosting providers themselves and layering sanctions, a reward of up to $10 million, and international coordination on top of the indictment, the DOJ, State Department, FBI, and CISA are signaling that they intend to disrupt the supply chain of cybercrime rather than only respond after each individual attack.

 

The bottom line

Bulletproof hosting providers give cybercriminals the anonymity and infrastructure they need to launch ransomware, phishing, and brute-force campaigns against hospitals, banks, schools, and government systems worldwide. The indictment, paired with sanctions and a $10 million reward, shows federal agencies are pursuing the infrastructure behind attacks, not just the attackers, as part of an effort to make it harder for cybercriminals to operate anonymously.

 

FAQs

What is bulletproof hosting?

It's a hosting service that knowingly ignores abuse complaints and law enforcement takedown requests so cybercriminals can keep their infrastructure online.

 

Why would U.S. prosecutors indict people who live in Russia and may never be arrested?

An indictment creates a public legal record and travel restriction that can limit a suspect's movement, freeze assets, and pressure allies or business partners even without an arrest.

 

What is the Rewards for Justice program?

It's a U.S. State Department program that pays cash rewards, and sometimes offers relocation, to people who provide information leading to the identification or location of individuals involved in threats to U.S. national security.

 

How do U.S. sanctions affect people who are already out of reach of U.S. courts?

Sanctions block the sanctioned individuals and companies from the U.S. financial system and can deter foreign banks or partners from doing business with them.