US charges three Russians behind 'bulletproof' hosting service used by LockBit and Play ransomware

Key points

• US federal prosecutors on 14 July 2026 unsealed charges against three Russian nationals accused of running Media Land and ML.Cloud, hosting services used by ransomware gangs.
• Prosecutors link the two services to more than $62 million in damages to victims in 21 US states, including hospitals, schools and banks.
• The State Department is offering up to $10 million for information on foreign government links to the operators or the companies.
• The US, UK and Australia sanctioned the three defendants in November 2025; the EU added its own sanctions this week alongside the UK.
• Named customers of the hosting operation include the LockBit, BlackSuit and Play ransomware gangs.

Three Russian men have been charged in the United States with running a hosting business that rented servers to some of the world's most damaging ransomware gangs.

Ransomware is malicious software that locks a company's files until the criminals are paid to release them. Those gangs need somewhere to run their attack servers, and that's what the accused men allegedly sold.

The indictment, unsealed on 14 July 2026 and first reported by BleepingComputer, names Aleksandr Volosovik, who went by "Yalishanda" on criminal forums, as the owner of Media Land. Yulia Pankova is accused of owning the sister service ML.Cloud and handling legal and financial paperwork. Kirill Zatolokin allegedly collected customer payments.

What is "bulletproof" hosting?

It's hosting sold to criminals on the promise that the provider will ignore complaints and shrug off police takedown requests.

A normal web host pulls a server offline when it gets an abuse report. A bulletproof host doesn't. That's the whole product. Prosecutors say Media Land and ML.Cloud advertised exactly this service, renting infrastructure across Russia, China, Finland, the Netherlands and the United States.

The servers supported malware delivery, the command-and-control panels ransomware gangs use to manage infections, phishing pages (fake login screens built to steal passwords), and distributed denial-of-service attacks, which flood a target with junk traffic until it goes offline. We covered the takedown of a comparable bulletproof operation in May, when French and Dutch police shut down a VPN service tied to LockBit affiliates and roughly two dozen other ransomware brands.

Who got hurt?

US Attorney David M. Toepfer said victims sat in Ohio and 20 other states, among them banks, schools, government entities, hospitals and media companies. Total damage tied to the hosting operation, per the indictment, tops $62 million.

The Treasury's Office of Foreign Assets Control noted in November that Media Land's servers were used to launch denial-of-service attacks against US telecoms and other critical infrastructure. LockBit, BlackSuit and Play, the named ransomware customers, have between them hit hospitals, city governments and large corporations across multiple continents.

What are governments doing about it?

All three men and both companies were already under sanctions from the US, UK and Australia as of November 2025. This week the Council of the European Union added its own sanctions against Media Land, ML.Cloud and Volosovik, in what Brussels called the first joint cyber sanctions package issued with the UK against Russia. Yesterday's broader EU-UK action against Russian spy hackers, which we reported on 13 July, suggests the two sides are coordinating more deliberately than at any point in recent memory.

Through its Rewards for Justice programme the State Department is offering up to $10 million for information on any foreign government links to the three men or the two companies. That wording signals Washington suspects, or wants to test, ties between the hosting business and the Russian state.

None of the three defendants is in US custody. All are believed to be in Russia, which doesn't extradite its nationals.

Should you worry?

Sanctions and indictments don't, by themselves, unplug a server rack in Saint Petersburg. They do raise the cost of doing business with the accused: any Western firm found paying a ransom that flows to sanctioned entities risks its own penalties.

Organisations that suspect they were hit by LockBit, BlackSuit or Play in the last two years should preserve their incident logs. The Justice Department is actively building cases, and victim data is what makes those cases hold up in court.