Adversary Intelligence — 2026-07-14

US Indicts Three Russians Running Media Land Bulletproof Hosting That Shielded Ransomware and Fraud Operations

BLUFLayering indictments atop sanctions and a $10 million reward degrades Media Land's commercial viability but accelerates operator migration to bulletproof-hosting alternatives Western agencies have yet to penetrate.

The Justice Department on Tuesday indicted three Russian nationals from St. Petersburg, Aleksandr Volosovik, Kirill Zatolokin, and Yulia Pankova, along with Media Land LLC and ML.Cloud LLC, on charges of conspiracy to commit computer fraud, wire fraud, and money laundering 123. The 75-page indictment, handed down in December 2024 and unsealed Tuesday, alleges the defendants operated a bulletproof-hosting service from a St. Petersburg office that shielded ransomware and malware operators targeting hospitals, schools, banks, and government entities in Ohio and at least 20 other states, causing an estimated $62 million in damages 13. US Attorney David Toepfer said victims included entities in Cleveland, Elyria, Akron, Medina, and Valley View 3. The three defendants and Media Land were sanctioned in November 2025 following a joint FBI, UK, and Australian investigation, and the State Department is now offering up to $10 million for information on the company, its executives, or foreign government-linked use of its infrastructure 123.

Analysis
The unsealing, eight months after a sealed December 2024 indictment, layers criminal charges atop November's sanctions and the $10 million reward, squeezing Media Land's revenue and personnel network rather than securing custody. All three defendants remain in Russia beyond US extradition reach, so the action functions as disruption rather than closure, and FBI officials expect displaced ransomware and fraud operators to migrate toward alternative bulletproof-hosting providers Western law enforcement has not yet mapped. Three independently reporting outlets covering the same DOJ announcement, plus a duplicate pickup and one secondary account, give broad but not fully independent corroboration. The eight-month gap between sealing and unsealing suggests the disclosure was timed to publicize the reward rather than reflecting new investigative developments, with the Ohio-specific damage figures also serving domestic prosecutorial and political utility.

5 sources