The threat involves operators of Russian bulletproof hosting services—Media Land and ML.Cloud—that provided resilient infrastructure to ransomware gangs and other cybercriminals. These services ignored victim complaints and law enforcement takedown requests, enabling malware distribution, command-and-control operations, phishing, illicit content hosting, and DDoS attacks. The indicted individuals managed ownership, legal/financial matters, and payment collection. Their infrastructure was used in attacks against critical U.S. infrastructure and entities across 21 states. The operators were sanctioned by multiple governments and are now criminally charged by U.S. federal prosecutors. The U.S. Department of State offers rewards for information on their activities or foreign government links.

The bulletproof hosting services facilitated ransomware and cybercrime operations that caused over $62 million in damages globally. Their infrastructure supported multiple ransomware gangs and enabled attacks on critical infrastructure, including telecommunications and various sectors such as banks, schools, hospitals, and government entities in the U.S. The services' refusal to comply with takedown requests prolonged malicious activities and complicated law enforcement efforts.

This is a law enforcement action targeting the operators of bulletproof hosting services. There is no direct patch or technical remediation applicable to software or systems. Organizations should remain aware of the role of bulletproof hosting in cybercrime infrastructure and continue to collaborate with law enforcement and sanctioning bodies. The U.S. Department of State offers a reward for information that could aid in disrupting these operations.