U.S. Prosecutors Charge Russian Trio in Cybercrimes Causing More Than $62 Million in Losses

Federal prosecutors have charged three Russian nationals over infrastructure that allegedly enabled ransomware, malware, phishing, and other cyberattacks against organizations in the United States and abroad.

The seven-year investigation links the activity to more than $62 million in victim losses across essential sectors.

The alleged operation did not depend on one named malware family. Instead, it focused on internet hosting designed to remain available despite abuse complaints, allowing criminal customers to operate systems, hide their activity, and target victims.

Banks, schools, hospitals, government bodies, and media companies were among those affected.

Justice.gov said in a report shared with Cyber Security News (CSN) that noted that Media Land and ML.Cloud allegedly gave cybercriminals the server infrastructure and technical support needed to infect computers, deploy ransomware, and demand payments in money or cryptocurrency.

The services also allegedly supported phishing, password-guessing attacks, fraudulent domain registrations, and criminal marketplaces.

The case shows why the infrastructure behind attacks can be as damaging as the people who launch them. When hosting providers knowingly shield criminal users, they can make large-scale campaigns harder to trace, disrupt, and stop before they reach their next victim.

U.S. Prosecutors Charge Russian Trio in Cybercrimes

A federal grand jury returned the indictment in December 2024, charging Alexander Alexandrovich Volosovik, Kirill Andreevich Zatolokin, and Yulia Vladimirovna Pankova with computer fraud, wire fraud, money laundering, and related conspiracy offenses.

The indictment was unsealed by the U.S. Attorney’s Office for the Northern District of Ohio.

Prosecutors also named St. Petersburg-based Media Land LLC and ML.Cloud LLC, which allegedly operated as so-called bulletproof hosting providers.

These services are marketed to users seeking servers that can withstand takedown requests, creating a resilient base for malicious activity.

Readers can learn more about bulletproof hosting companies facing charges and their role in the cybercrime economy.

According to the Justice Department, Media Land operated infrastructure from several countries, including China, Finland, the Netherlands, and the United States.

Prosecutors allege that its services supported clients who infected victim systems and then attempted to extort them for payment.

The victims were located in 21 U.S. states, as well as Australia, Canada, the European Union, the United Arab Emirates, and the United Kingdom. In Ohio, affected locations included Akron, Cleveland, Elyria, Medina, Solon, and Valley View.

The U.S. State Department’s Rewards for Justice program is offering up to $10 million and possible relocation for actionable information about foreign government-linked associates of the defendants, their alleged activity, or foreign government-linked use of Media Land and ML.Cloud.

Infrastructure Crackdown Raises Costs

The action builds on sanctions announced in November 2025, when U.S., UK, and Australian authorities targeted Media Land for allegedly facilitating ransomware operations, distributed denial-of-service attacks, and other malicious activity.

The European Union also announced sanctions on July 13, adding pressure on the alleged network.

Sanctions can disrupt the financial and technical foundations that support cybercrime, but they do not remove the wider threat.

Earlier Russian hosting provider sanctions demonstrated how authorities are increasingly targeting services that make ransomware, scams, and malware campaigns more durable.

For defenders, the case reinforces the need to reduce opportunities for attackers before an intrusion becomes an extortion event.

Organizations should keep systems patched, use multi-factor authentication, monitor unusual logins and outbound connections, maintain tested offline backups, and ensure staff can recognize suspicious email messages.

Current phishing and ransomware attack trends show why those basic controls remain important.

The Cybersecurity and Infrastructure Security Agency has also highlighted its joint BulletProof Defense guide as a resource to help organizations reduce the effectiveness of malicious hosting infrastructure.

Understanding Qilin ransomware hosting risks can further help security teams recognize why the servers behind an attack deserve as much attention as the malware itself.

The charges remain allegations, and the defendants are presumed innocent unless proven guilty in court. Still, the case signals continued international efforts to expose the providers, operators, and financial structures that allow cybercriminal groups to work across borders.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post U.S. Prosecutors Charge Russian Trio in Cybercrimes Causing More Than $62 Million in Losses appeared first on Cyber Security News.