THREE RUSSIAN NATIONALS INDICTED IN ALLEGED $62 MILLION GLOBAL CYBERCRIME OPERATION TARGETING CRITICAL INFRASTRUCTURE

CLEVELAND — Federal prosecutors have unsealed a sweeping indictment charging three Russian nationals and two Russia-based companies with operating an alleged international cybercrime infrastructure that enabled ransomware attacks, malware campaigns, phishing operations, wire fraud, money laundering, and other cyber offenses that investigators say caused more than $62 million in losses to victims across the United States and multiple foreign countries.

The indictment, returned by a federal grand jury in December 2024, follows a seven-year international investigation led by the Federal Bureau of Investigation (FBI) and alleges the defendants operated one of the internet’s largest “bulletproof hosting” services, providing cybercriminals with resilient infrastructure designed to resist law enforcement disruption while facilitating attacks against businesses, government agencies, hospitals, schools, financial institutions, and other critical infrastructure.

The defendants charged in the indictment are:

• Alexander Alexandrovich Volosovik, 43, of St. Petersburg, Russia
• Kirill Andreevich Zatolokin, 34, of St. Petersburg, Russia
• Yulia Vladimirovna Pankova, 29, of St. Petersburg, Russia
• Media Land, LLC
• ML.Cloud, LLC

Federal prosecutors charged the defendants with:

• Conspiracy to Commit and Aid and Abet Computer Fraud
• Conspiracy to Commit Wire Fraud
• Wire Fraud
• Conspiracy to Commit Money Laundering

According to the indictment, Media Land and ML.Cloud allegedly provided server infrastructure, internet services, technical support, and hosting environments intentionally designed for cybercriminal organizations seeking to conceal malicious operations from investigators. The indictment identifies Media Land as being owned by Alexander Volosovik, while ML.Cloud is identified as being publicly owned by Yulia Pankova.

Investigators further allege that Volosovik operated online using multiple aliases, including Yalishanda, downlow, nishebrod, and Ohyeahhellno, while Zatolokin allegedly used the online identities slim shady, g_host, podzemniy, and podzemniyl.

---

Alleged “Bulletproof Hosting” Operation

According to court documents, the defendants allegedly operated internet infrastructure specifically designed to shield criminal operations from disruption.

The indictment alleges the companies controlled multiple Autonomous System Number (ASN) blocks containing thousands of internet protocol (IP) addresses hosted on infrastructure located in Russia and the Netherlands, while also leasing additional server infrastructure through providers in the United States. Prosecutors allege the defendants expanded portions of their infrastructure to more than 5,800 IP addresses during the investigation.

Federal prosecutors allege the defendants knowingly leased infrastructure to numerous criminal organizations responsible for deploying ransomware, malware, phishing campaigns, brute-force attacks, fraudulent domains, and cryptocurrency-based extortion schemes.

The indictment identifies at least 17 separate criminal client conspiracies that allegedly relied on Media Land and ML.Cloud infrastructure to infect victim computers, encrypt systems, demand ransom payments, conduct brute-force attacks, or otherwise facilitate cybercrime.

According to prosecutors, some alleged criminal customers also used infrastructure provided by the defendants to route ransomware payments through cryptocurrency wallets and conceal malicious activity behind false domain registrations and proxy services.

---

Victims Across the United States and Abroad

Federal investigators allege organizations victimized through the infrastructure operated by the defendants included:

• Banks
• Hospitals
• Schools
• Government agencies
• Media organizations
• Commercial businesses
• Municipal governments
• Critical infrastructure operators

The indictment identifies victims located throughout the United States, including organizations in:

• Ohio
• California
• Delaware
• Florida
• Georgia
• Illinois
• Louisiana
• Maryland
• Massachusetts
• Michigan
• Minnesota
• New Hampshire
• New York
• North Carolina
• Pennsylvania
• Tennessee
• Texas
• Utah
• Virginia
• Washington
• Wisconsin

International victims allegedly included organizations located in:

• Canada
• Australia
• The United Kingdom
• The European Union
• The United Arab Emirates

The indictment also identifies numerous specific victim locations, including municipalities, businesses, and organizations in Cleveland, Akron, Canton, Elyria, Medina, Solon, Valley View, Findlay, and other communities affected by the alleged cyber activity.

Federal authorities estimate the alleged cyber activity caused more than $62 million in losses.

---

Reward and International Sanctions

Alongside the unsealing of the indictment, the U.S. Department of State’s Rewards for Justice Program announced a reward of up to $10 million for information concerning the defendants, their alleged cyber activities, or foreign government-linked use of Media Land or ML.Cloud.

Federal officials also announced that the defendants and their companies were previously sanctioned by the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC). Additional sanctions have since been announced by the European Union, United Kingdom, and Australia as part of broader international efforts targeting cybercrime infrastructure.

---

International Investigation

The investigation was led by the Federal Bureau of Investigation Cleveland Division with assistance from:

• Cybersecurity and Infrastructure Security Agency (CISA)
• Office of Foreign Assets Control (OFAC)
• National Police of the Netherlands
• Public Prosecutor’s Office of the Netherlands
• United Kingdom National Crime Agency
• United Kingdom Foreign, Commonwealth & Development Office
• Australian Federal Police
• Australian Department of Foreign Affairs and Trade

The case is being prosecuted by Assistant U.S. Attorney Duncan T. Brown and Trial Attorney Christen Gallagher of the Department of Justice’s Computer Crime and Intellectual Property Section.

Because this matter remains pending before the court, the indictment contains allegations only. All defendants are presumed innocent unless and until proven guilty in a court of law.

---

---

---

U.S. Department of Justice, U.S. Attorney’s Office for the Northern District of Ohio; Federal Bureau of Investigation; Federal Grand Jury Indictment, United States v. Alexander Alexandrovich Volosovik, et al., U.S. District Court for the Northern District of Ohio. (Free Download)

---

---

---

---

---

---

---

---

---

---

🔥 NOW AVAILABLE! 🔥

‎👉 Eclipsera – Apple Music

---

---

---

---

---