Executive Summary and Provider Overview

Quick-Reference Attributes

Overall Assessment

Media Land LLC, operating under the underground brand "Yalishanda," is among the most thoroughly documented and longest-running Russian bulletproof hosting providers in the threat landscape, with confirmed activity from approximately 2009 to present. As of this revision the provider and its principals face the most complete Western enforcement stack applied to any BPH operator to date: criminal indictment in the United States, sanctions in four jurisdictions, and a $10 million intelligence bounty. None of it has yet altered the infrastructure.

Confirmed On 14 July 2026 the Department of Justice unsealed an indictment returned under seal on 5 December 2024 in the Northern District of Ohio, charging Volosovik, Zatolokin, Pankova, Medialand LLC, and ML.Cloud LLC with conspiracy to commit and aid and abet computer fraud, conspiracy to commit wire fraud, ten counts of wire fraud, and conspiracy to commit money laundering. The indictment names 42 US victim organizations across 21 states, with more than $62 million in documented losses, and identifies victims including banks, schools, government entities, hospitals, and media companies. The case is prosecuted by CCIPS Trial Attorney Christen Gallagher and AUSA Duncan T. Brown, investigated by FBI Cleveland with CISA and OFAC support, and materially assisted by the Dutch National Police and Public Prosecutor's Office, the UK National Crime Agency, and Australian authorities. [16]

Confirmed The indictment corrects a significant element of the prior assessment. Media Land's infrastructure was not confined to Russia: it operated out of Finland, the Netherlands, and the United States. That multi-jurisdictional footprint explains both the seven-year investigative timeline and the participation of Dutch law enforcement, and it materially changes the disruption calculus, because a portion of the estate sits inside jurisdictions where Western legal process reaches. It also reframes the provider's own marketing: Zatolokin's claim to BlackBasta that "this is all our own: our own data center, our own hardware" described the Russian core, not the whole estate. [16][17]

Confirmed The indictment also establishes that Pankova owned ML.Cloud LLC at the time of investigation, upgrading her from the support role assessed in v1 to a principal. It documents a fast-flux DNS product advertised on Exploit in December 2018 at $150 to $500 per month, a client database of roughly 389 usernames and more than 5,000 domains, service to 17 or more criminal groups, eight named carding marketplaces, and hosting for the Ermac and RedAlert Android banking trojans. [16][19][20]

Confirmed Separately, on 13 July 2026 the Council of the European Union designated Media Land LLC, ML.Cloud, and Volosovik under the EU cyber sanctions regime, making the EU a fourth sanctioning authority. The action was taken simultaneously with a UK package covering a different target set, the first time the EU and UK have acted at the same time under their respective cyber regimes. [21][22]

Status is held at Degraded rather than escalated to Disrupted. AS206728 remains fully active with all eight IPv4 and two IPv6 prefixes announced. No defendant is in custody, no servers have been seized, and Russia has no extradition treaty with the United States. FBI Cyber Division Assistant Director Brett Leatherman stated after the unsealing that the bureau believes Media Land "is likely still shielding criminal activity" and is actively monitoring for client migration. The enforcement stack is now near-complete on paper and almost entirely unrealized in effect: the practical pressure runs through financial and intelligence channels rather than any near-term prospect of trial. [19][20]

Rewards for Justice tip poster released with the unsealed indictment, advertising up to $10 million and possible relocation for information on foreign government-linked associates of the three defendants.

U.S. Department of Justice / Department of State RFJ, July 2026

Russian-language version of the same Rewards for Justice poster. Publication in Russian indicates the intended audience is inside Russia or the Russian-speaking underground, consistent with an insider-recruitment objective.

U.S. Department of Justice / Department of State RFJ, July 2026

Photo of Kirill Zatolokin released alongside the OFAC designation, showing him in what appears to be a Media Land corporate office wearing a company branded shirt.

U.S. Department of the Treasury / OFAC, November 2025

Image released by OFAC showing Aleksandr Volosovik and Yulia Pankova, confirming the personal relationship between two individuals now established by indictment as owners of Media Land and ML.Cloud respectively.

U.S. Department of the Treasury / OFAC, November 2025

Passport scan of Aleksandr Volosovik published by KrebsOnSecurity in July 2019, issued by the Russian Embassy in Beijing, confirming identity and the China connection seven years before charges were unsealed.

KrebsOnSecurity / Intel 471, July 2019

Analyst1 "Infrastructure in the Shadows" report cover, January 2026, which correlated the BlackBasta chat leak and the Media Land internal data leak to expose the operational relationship between Yalishanda and BlackBasta.

Analyst1, January 2026

Leaked BlackBasta chat in which Zatolokin (Slim Shady) offers access to Media Land's privately owned data center, confirming VIP client tiering and own-hardware capability for the Russian core of the estate.

Analyst1 / Leaked BlackBasta chats, January 2026

Lineage and Organizational Heritage

Entity and Brand Timeline

Predecessor Lineage and Early History

Yalishanda's criminal activity is confirmed from approximately 2009 and assessed to extend into the late 2000s. KrebsOnSecurity first encountered the persona in 2010 in connection with "Fizot," a botnet anonymization service built on TDSS-infected Windows machines. A 2010 registration for mo0be-world[.]com tied to [email protected] and the name Aleksandr Volosovyk provided the first documented link between persona and real identity. [1]

By 2011 Yalishanda was advertising under real-hosting[.]biz. Intel 471 and Cisco researchers identified Yalishanda as a top-tier BPH provider at Black Hat 2017, noting that in a single 90-day period in 2017 the infrastructure hosted Dridex, Zeus, and multiple ransomware families. [1]

Confirmed New in v2 The indictment pushes documented Media Land operational history back to at least 2014, predating both open forum advertising under that structure and the October 2015 incorporation. It also places the company in a semi-industrial district of St. Petersburg. By August 2016 Volosovik and Zatolokin were advertising on the Dark Money forum under the pseudonym "podzemniy." [16][19][20]

Evidentiary Pillars

Operator Profiles

2.1 Aleksandr Alexandrovich Volosovik: Owner and Principal Operator

2.2 Yulia Vladimirovna Pankova: Owner of ML.Cloud LLC Substantially revised in v2

2.3 Kirill Andreevich Zatolokin: Payments and Client Coordination

2.4 Andrei Valerevich Kozlov: Sanctioned, Not Indicted

2.5 "lapa": Infrastructure Staff, Alias Only

Disputed Assessments

Cl0p as a client: RESOLVED AGAINST. The indictment has now been read. It names no ransomware group at all, referring throughout to Client Conspirators 1 to 17, each using "a specific malware or ransomware variant, known to the Grand Jury." Trade reporting asserting that the indictment charges hosting for Cl0p is not supported by the document, and Cl0p appears in neither the indictment nor either DOJ press release. The claim is downgraded to Analyst Inference with no supporting primary evidence, and should not be carried into published product.

Two client conspirators are nonetheless identifiable from domain evidence in the indictment. Client Conspirator 4 established Egregorwiki.top and Wikiegregor.top (paragraph 169), pointing to Egregor. Client Conspirator 5 is associated with snatch.team through domain-expiry correspondence at paragraph 171(a) and (b), pointing to Snatch. Both are Analyst Inference drawn from the document, not government attributions, and both should be labelled as such.

Kozlov's function. Unresolved. See 2.4.

Resolved since v1. v1 flagged Pankova's and Kozlov's functional roles as an open question. Pankova's is now resolved (owner, ML.Cloud). Kozlov's remains open.

Operational and Business Model

Service Model

Confirmed Media Land and ML.Cloud sold servers, IP addresses, domains, SOCKS proxies, fast-flux DNS, and DDoS-resistant hosting to cybercriminal clients. The indictment characterises the offering as infrastructure that let clients both conduct criminal activity and evade law enforcement detection, marketed knowingly and intentionally to cybercriminals. Documented service categories include malware and ransomware delivery, victim extortion support, criminal marketplace hosting, fraudulent domain registration, and platforms for launching phishing and brute-force attacks. [16]

Two structural differentiators separate Media Land from most Russian BPH peers: owned physical data center hardware in the Russian core, marketed explicitly as superior to rented networks, and a mature fast-flux product sold as a distinct line item.

Fast-Flux Service Confirmed from indictment

Confirmed The indictment defines fast-flux as associating multiple IP addresses with a single domain and changing them rapidly, sometimes across hundreds or thousands of addresses, to keep properties reachable, hide the origin of malicious activity, and defeat ISP blocking. Media Land ran this as a distinct product on the ffv2.ru platform with an "ffpanel" web application, backed by a database of 41 tables recording registered users, domains, DNS accounts and credentials, service costs and cryptocurrency transactions. [24]

Confirmed Three separate advertisements are quoted in the indictment. Pricing is not stated as a period rate in the quoted text; the tariffs are reproduced as written. The 2016 and 2019 posts are denominated in WebMoney (WMZ), the 2018 post in dollars.

Free VPS specification quoted as 2000 MHz / 1 GB / 50 GB. Correction to v1: Trade reporting gave only the $150 and $500 endpoints and described them as monthly. The ladder has four tiers, the currency differs by year, and no period is stated in the quoted advertisements.

SOCKS5 Proxy Service New in v2

Confirmed A separate product line not recorded in v2. On 12 October 2023 Yalishanda posted on Exploit.in under the topic "Socks5/https proxy service for brute force and various checkers, also ipv6 with open port 25," edited 23 March 2024, and reposted the same advertisement to XSS.IS on 13 November 2023. Two tariffs: 5,000 US and EU IPs with unlimited threads at $200, and several billion IPv6 addresses with open port 25, accessed via IPv4, at $500. The advertisement states the pool is refreshed daily and that the proxies suit brute-force and checker workloads. Open port 25 across a very large IPv6 pool is a direct spam-delivery capability. [24]

Fast-Flux Panel Feature Set New in v2

The December 2018 advertisement describes a custom proxy layer written in-house, replacing nginx and haproxy, deployed inside an encrypted container on the node. Per the copy, the container is accessible only until the first reboot, after which "access to it is lost even from us," a design explicitly marketed as preventing data center administrators from reading the config or determining the client's real backend IP. It also claims the proxy generates decoy connections to unrelated addresses using the same packet sizes as the real backend to frustrate traffic analysis, uses only KVM and XEN virtualisation, allocates each client a non-overlapping IP pool, and runs an automated checker that swaps NS servers within a minute of a domain being blocked. Three domain registrars are offered, described in the advertisement as being in Europe, China and Malaysia, which the seller characterises as "loyal" rather than bulletproof.

Verbatim Advertising and Operator Communications

Language and Supplier Reach New in v2

Confirmed The December 2018 Exploit advertisement lists support and billing channels in three languages: Jabber: billing2 (RU/ENG/CH), Jabber: Support (RU/ENG/CH), and a Telegram support and billing channel also marked RU/ENG/CH. Chinese-language customer support was a standing offering, not an ad hoc accommodation, which implies a Chinese-speaking client segment of some size. [24]

Confirmed The WhatsApp traffic between the principals records recurring procurement of Chinese proxy infrastructure and recurring problems with it. On 26 August 2017: "I have used some of that money to pay the Chinese on Yandex. You can see one of ours is dead. I can buy more, but you need to order socks." On 2 September 2017: "We had experienced that before with the Chinese. It's probably an account that was banned, so money cannot be added to it." On 9 September 2018: "Try a Chinese one, but you have to make sure he can open his ports," followed by "No, ports are closed. These Chinese proxies only have ports 80 and 443 open." [24]

Onboarding and Client Tiers

Forum advertising on Exploit[.]in, XSS[.]pro, Dark Money and predecessor platforms was the primary acquisition channel. Support ran through Telegram (@ohyehhellno) and Jabber, both listed consistently in advertising. No invitation-only or referral gate is documented.

A two-tier client structure is evident from leak data. Standard clients self-served through forum-advertised support channels. VIP clients such as BlackBasta held direct relationships with Zatolokin for custom deployments, bandwidth negotiation, and capacity planning, with access to owned data center hardware. [3]

Confirmed New in v2 Indictment-derived scale figures: approximately 389 usernames and more than 5,000 registered domains in the client database. Against 17 or more criminal groups served, this implies most usernames were individual criminal customers rather than group accounts, and that domain provisioning ran at roughly 13 domains per username. [19][20]

Abuse-Handling and Law Enforcement Posture

Confirmed Total non-cooperation was the advertised and practised posture. Forum advertising explicitly named Spamhaus as ignored. The indictment alleges the defendants repeatedly ignored or falsified abuse reports and rotated infrastructure to stay ahead of takedowns. The falsification allegation is new in v2 and is materially more serious than passive non-response: it implies active deception of upstream providers and registrars, which is also what makes the multi-jurisdictional footprint sustainable. [16]

Confirmed New in v2 The indictment specifies the mechanism. Abuse reports, intrusion alerts and anti-virus output were deliberately funnelled into operator-controlled mailboxes designed to look independent: [email protected], [email protected], [email protected] and [email protected]. Rather than suspending offending domains or accounts, the operators sent false replies, ignored reports, or offered the complaining client fast-flux to defeat the detection that had generated the report. Paragraph 123 lists four services sold on this basis: fraudulent abuse-report responses, rapid IP rotation, domain registration through the front company with added privacy services, and other protections shielding clients during intrusions and exfiltration.

Spamhaus had identified the platform early. On 12 November 2014 a forwarded Spamhaus notice reached [email protected] stating that s777shop.ru and ffv2.ru were "operated by cybercriminals and used to control infected computers (bots) using a so called botnet controller," and requesting suspension. The domain was blocked and Volosovik contested the block with the registrar two days later. The platform continued operating for another decade.

The only documented instance of customer dispute resolution across 15+ years is the August 2020 arbitration in which Yalishanda refunded $222.89 to a user called Loadbaks with a bare transaction hash and no acknowledgment.

OPSEC Posture

Volosovik registered Media Land LLC as a legitimate Russian entity to obtain commercial legitimacy, enabling contracts, IP leasing, and staff employment. His VKontakte and Odnoklassniki profiles used partial real-name attribution, indicating confidence in the Russian operating environment rather than technical OPSEC discipline. The sealing of the indictment for more than nineteen months suggests investigators judged that continued collection outweighed the deterrent value of early disclosure.

Technical Capabilities and Infrastructure Footprint

Autonomous Systems Corrected from indictment

Multi-Jurisdictional Infrastructure Footprint Corrected in v2

China Nexus: Supplier and Market, Not Hosting New in v2

Analyst Inference The documented pattern is a provider that bought Chinese proxy capacity, resold Chinese domain registration, and marketed in Chinese, run by two principals with years of personal residence in Beijing. That is a supplier and customer-base relationship, not an infrastructure footprint. The most economical explanation for the press release wording is that it generalises from these relationships rather than describing servers in China. Analysts should not carry "Media Land hosted infrastructure in China" forward without reading Counts 2 to 4 or obtaining separate technical corroboration.

IPv4 Prefix Table (AS206728)

Note: 45.141.87.0/24 is the prefix containing IP 45.141.87.127, cited in Zatolokin's speed-test message to BlackBasta. It is registered to an individual name (Grisha Maslinikov) rather than a corporate entity, and 193.242.153.0/24 is registered to IT Outsourcing LLC and lacks a ROA. Both are candidate nominee registrations worth further examination.

IPv6 Prefixes (AS206728)

Named Infrastructure Estate New in v2

Confirmed The indictment names the criminal-side infrastructure directly, which the press release did not. This is the operational core of the BPH service, run on servers deliberately separated from the public-facing ML.Cloud estate.

Post-Indictment Domain and IP Sweep, 27 July 2026 New v2.2

All 56 domains named in the paragraph 253 enhancement were checked against RDAP registration data and live DNS, and the resolved addresses were traced back to their announcing networks. Method: RDAP for registration state, DNS-over-HTTPS for current resolution, RIPE and Hurricane Electric for prefix attribution. Analyst Inference throughout on questions of who controls what, since registration records for these domains are privacy-shielded and .ru carries no public RDAP.

Falsely Registered Domains (18 U.S.C. 3559(g)(1)) New v2.1

Confirmed Paragraph 253 of the indictment enumerates roughly 56 domains that Volosovik and Zatolokin registered with false names and addresses and used in furtherance of Counts 1 to 13. This list appears in no press release and is the single largest set of new indicators the document provides. Grouped below by evident function.

Analyst Inference Two operational reads. First, the heavy .info and .ru concentration is consistent with the advertised "Europe, China and Malaysia" registrar set, which the seller described as loyal rather than bulletproof. Second, the presence of brand-impersonation domains alongside DNS plumbing in the same charged set indicates Media Land was registering phishing domains for clients as a service, not merely hosting infrastructure that clients populated themselves. That is a more active role than the hosting-only framing in the press releases.

Third-Party Providers New in v2

Analyst Inference Both ISPs are US entities that were, on the government's account, taking payment from Media Land for years. Neither is charged. That the fast-flux platform central to the whole scheme sat on a leased server in New Jersey until June 2024 is the single most consequential fact in the document for disruption purposes, and it is also the most likely explanation for the seven-year investigative timeline: US-hosted infrastructure is reachable by subpoena and search warrant in a way the Russian estate is not.

Upstream Transit Chain

De-peering events: Confirmed No documented upstream de-peering events for AS206728 in open sources, including in the period following the November 2025 sanctions and the July 2026 indictment and EU designation. All four observed peers remained in place across the latest BGP snapshot. Unlike PROSPERO (AS200593, Bearhost), which drew public scrutiny over a Kaspersky Lab upstream relationship in 2025, no equivalent upstream controversy has been reported for MEDIALAND-AS. The absence of de-peering after four-jurisdiction sanctions and a US indictment is itself a finding: the Russian upstream chain is not responsive to Western designation, and SYSECT D.O.O. in Montenegro is the only peer plausibly subject to European pressure.

Physical Infrastructure and Capacity

Confirmed Data Center Kirishi, a wholly owned subsidiary registered July 2022 in Kirishi, Leningrad Oblast, represents owned physical data center capacity with own hardware, confirmed by Zatolokin directly to a client. This differentiates Media Land from BPH operators that lease all upstream capacity. Documented capacity from the BlackBasta negotiation: standard plan of 20 Gbps per 100 servers, with the client's approximately 200-server deployment consuming 17 to 20 Gbps and a proposed scale to 50 Gbps. [3]

Hosted Activity Types

• Malware command-and-control servers
• Fast-flux DNS evasion infrastructure New in v2
• Code-signing infrastructure
• Phishing kit hosting and phishing launch platforms
• Brute-force attack launch platforms New in v2
• Data exfiltration panels
• Ransomware operational platforms and victim extortion support
• Data leak site hosting
• Criminal marketplace hosting, including eight named carding markets New in v2
• Fraudulent domain registration New in v2
• DDoS botnet infrastructure, including attacks on US critical infrastructure and telecommunications
• SOCKS proxy networks layered over Media Land servers
• Android banking trojan infrastructure (Ermac, RedAlert) New in v2

Blocklist Standing

Known Weaknesses

Revised in v2. The correction to the infrastructure jurisdiction picture changes the weakness profile substantially.

• Western-jurisdiction infrastructure. Physical infrastructure in the Netherlands, Finland, and the United States is directly reachable by Western legal process. This is the single most actionable weakness identified in this profile and did not appear in v1. Dutch authorities have demonstrated both capability and willingness in this space, seizing 800 servers from Stark Industries in May 2026
• Infrastructure concentration. All announced prefixes sit under a single ASN, making AS-level blocking straightforward for defenders
• Thin peering. Four observed upstream peers provide limited routing redundancy
• Fixed owned hardware. DC Kirishi is a locatable, immovable choke point, subject in principle to Russian domestic action that has not materialised
• Financial exposure. Four-jurisdiction sanctions plus an SDN-listed Bitcoin address restrict compliant exchange access; clients face secondary sanctions exposure
• Insider risk. The $10M Rewards for Justice offer, published in Russian as well as English, is an explicit attempt to induce defection from within the operation or its periphery. The provider has already suffered one insider or adversary leak in March 2025
• Nominee registrations. Two prefixes registered to a named individual and to an unrelated LLC, one lacking a ROA, are potential attribution and enforcement handles

Financial Infrastructure

Payment Methods

Confirmed Cryptocurrency-only payment. Bitcoin and USDT (ERC-20) are documented in leak, sanctions, and indictment material. The indictment alleges the defendants accepted cryptocurrency specifically to protect client identities. No fiat payment channel is documented. [3][7][16]

Known Wallet Clusters

lapa Salary Payments (BlackBasta to Media Land Infrastructure Staff)

Total $94,000 USDT. Two additional BTC transactions on 1 April 2024 (0.01163 BTC and 0.01019 BTC, approximately $829 and $727) were paid by gg to lapa-supplied addresses for SOCKS proxy procurement. Source: Analyst1 / Arkham. [3]

On-Chain Volume

Confirmed TRM Labs documented more than $2 million in received volume across wallets linked to Yalishanda and Abushost, with direct and indirect flow intersections across BlackSuit, BlackBasta, LockBit, and MedusaLocker. [10]

Confirmed Chainalysis assessed Volosovik's services as supporting "nearly every component of the cyber kill chain," monitoring thousands of addresses and millions of dollars in transactions across underground exchanges, laundering services, scammers, hackers, and ransomware operators including sanctioned LockBit administrator Dmitry Khoroshev. [6]

New in v2 The DOJ figure of $62 million is a victim loss total across 42 named US organizations, not provider revenue. It should not be reconciled against the TRM $2M received-volume figure, which measures funds reaching identified Yalishanda-linked wallets. The two metrics measure different things and both are consistent: a BPH provider captures a small fraction of the downstream criminal proceeds its infrastructure enables.

Three-Phase Laundering Model

Phase 1, receipt. Ransomware payments reach client groups in Bitcoin. Media Land receives hosting fees in BTC or USDT, with fast-flux and bandwidth billed as recurring monthly subscriptions.

Phase 2, conversion. BlackBasta operator gg stated in leaked chats that funds paid to lapa for SOCKS procurement and salary came from money already "cleaned" by an internal laundering operation. USDT was used for stable-value salary payments post-laundering. TRM identifies flows to intermediary wallets and major global exchanges.

Phase 3, cash-out. Funds move through no-KYC exchanges and OTC desks consistent with Russian cybercrime cash-out patterns. Specific venues for Media Land and Volosovik remain unidentified in open sources, in contrast to ZServers where Garantex is confirmed. This remains an intelligence gap.

Sanctions and Regulatory Risk

EU measures impose an asset freeze, prohibit EU citizens and companies from making funds or economic resources available, and add a travel ban barring entry to or transit through EU territory for designated natural persons. The travel ban is a distinct instrument from the US and UK measures and narrows the set of countries the principals can transit, which matters given that arrests of Russian cybercrime suspects have historically occurred during travel. [21]

Client Profile and Hosted Operations

Client Conspirator Schedule (as charged) New in v2

Confirmed Seventeen client conspirators, sixteen described as groups conducting ransomware and extortion, one (CC17) conducting brute-force attacks and unknown to the Grand Jury. Fast-flux accounts on ffv2.ru are attributed to CC1, CC3 to CC8, and CC14.

Criminal Marketplaces Named in the Indictment Confirmed from indictment

Confirmed Paragraph 207 tabulates eight marketplaces and forums hosted on the ffv2.ru server as of 6 March 2023, each hosting representing a separate overt act. This upgrades the v2 CREDIBLE label to CONFIRMED and supplies the domains, which the press release lacked.

Malware Families Named in the Indictment Confirmed from indictment

Crimeware Verticals by Evidence Tier

Victimology New in v2

Analyst Inference The victim sector mix (hospitals, schools, government, banks) is characteristic of opportunistic ransomware affiliate targeting rather than directed collection against strategic targets. This weighs against a state-tasking interpretation of the client base, and is one reason the state nexus assessment is held at Tier 2 despite the Rewards for Justice framing discussed in Section 07.

Notable Hosted Cases

State Nexus Assessment

Jurisdictional Separation

All three jurisdictions remain analytically distinct and must not be conflated. The change in v2 is that the infrastructure jurisdiction is now the least Russia-concentrated of the three, having previously been assessed as the most.

Assigned Tier: TOLERATED SAFE HARBOR (Tier 2 of 4)

Escalation Indicator: Rewards for Justice Scope New in v2

Confirmed On 14 July 2026 the Department of State's Rewards for Justice program offered up to $10 million and possible relocation for actionable information on "foreign government-linked associates of Pankova, Volosovik and Zatolokin, their malicious cyber activities, or foreign government-linked use of Media Land or ML.Cloud." [16][18]

Analyst Inference This phrasing is unusual for a cybercrime bounty. RFJ offers in criminal cases more commonly seek information on identity, location, or assets. Scoping the offer to foreign-government-linked associates and foreign-government-linked use of the companies indicates the US government treats the question of state connection as open and investigatively live, and is willing to pay substantially to resolve it. Publication of the poster in Russian alongside English reinforces that the intended respondent is inside Russia or the Russian-speaking underground.

Three further contextual data points bear on the question without resolving it:

• TechCrunch characterised the two hosts as having provided infrastructure to "criminals and state-backed hackers," though this phrasing does not appear in the DOJ press release and is not sourced to a named official. Single Source
• The UK FCDO noted in its November 2025 designation that Volosovik worked with Evil Corp, a group whose senior leadership the US Treasury has previously linked to FSB tasking. This is a second-order link through a client, not a direct link.
• The EU's 13 July 2026 statement, issued the day before the unsealing, described a broader Russian cyber ecosystem in which the Russian Intelligence Services have "tasked cybercriminals to collect intelligence to support Russia's military and foreign policy objectives." Media Land was designated in the same package, but the tasking language was applied to the ecosystem and to specific GRU-linked entities such as IMPULS and CARR, not to Media Land. Analysts should not read the ecosystem statement as a Media Land-specific attribution.

Evidence Supporting Tier 2

• Volosovik was publicly named by KrebsOnSecurity in July 2019 with full identifying detail including a passport scan. No Russian domestic enforcement action followed in the seven years since.
• Media Land LLC has operated as a registered Russian entity since October 2015, filing required regulatory disclosures. Running a criminal BPH service through a registered company with a named director is only rational if domestic prosecution risk is assessed as negligible.
• Krebs observed in 2019 that BPH administrators operating from within Russia are unlikely to be arrested provided they remain in country. Validated by the continued at-large status of all four designated individuals through July 2026, now including through an unsealed US indictment.
• Russian state documentation continued to be issued to Volosovik through the period of peak Yalishanda activity, including the Beijing-issued travel passport.
• Moscow renewed warnings to Russian nationals against travel to countries that transfer suspects to US jurisdiction following the indictment, which is consistent with protective tolerance rather than either indifference or control.

Negative Evidence: Against Tier 3 or Tier 4

• No named Western intelligence service, government body, or vendor has asserted direct GRU, FSB, or SVR tasking of Volosovik, Pankova, Zatolokin, or Media Land. The RFJ offer seeks such information rather than asserting it.
• The indictment charges ordinary criminal statutes: computer fraud, wire fraud, money laundering. It contains no espionage, export control, or foreign agent counts, and DOJ's press release makes no state-nexus allegation.
• OFAC designated under E.O. 13694 (cyber-enabled activities) rather than any Russia state-actor-specific authority. The EU designated under the cyber sanctions regime (Decision 2019/797) rather than the Russia destabilising-activities regime (Decision 2024/2643), which it applied the same day to GRU-linked targets. This is a meaningful distinction in EU instrument selection: the Council placed Media Land in the criminal-ecosystem basket, not the state-actor basket.
• Victimology is characteristic of opportunistic ransomware monetisation (hospitals, schools, municipal government, banks) rather than directed collection against strategic or governmental targets.
• The client base is broadly commercial: ransomware affiliates, carding marketplaces, Android banking trojan operators, fraud operators, IABs. A state-tasked platform would be expected to show a narrower and more purposive client profile.

Indicators that would move the assessment to Tier 3. Documented handler relationships between any principal and an RIS officer; evidence that specific hosting was provisioned to a state-attributed intrusion set on request; RFJ-derived reporting that becomes public; a superseding indictment adding espionage or foreign-agent counts; or explicit attribution language in a future OFAC, FCDO, or EU designation. None of these is present as of 26 July 2026.

Law Enforcement and Regulatory Response

This section was rewritten in v2. v1 recorded no arrests, no indictments, and no charges.

Criminal Indictment New in v2

Analyst Inference The seven-month sealing period between return and unsealing, and the twenty-month gap between the December 2024 indictment and the July 2026 unsealing, indicate the charges were held while other activity proceeded. The November 2025 sanctions fell inside that window. The most probable reading is that the sanctions were sequenced first to impose financial cost while the criminal case remained protected, with unsealing timed to follow the EU designation and to accompany the Rewards for Justice launch as a combined pressure package.

Count Schedule New v2.1

Confirmed The DOJ press releases summarise the charges as four categories, which is accurate but compresses the structure. The document charges thirteen numbered counts and adds a sentencing enhancement and a forfeiture allegation that neither press release mentions.

Analyst Inference The three conspiracy counts carry three different start dates: computer fraud from March 2014, wire fraud from February 2016, money laundering from June 2016. The government is dating each conspiracy to the earliest act it can evidence for that offence rather than to a single origin point for the enterprise. The 17 December 2018 start for the substantive wire fraud counts is the date of the Exploit fast-flux advertisement, which suggests those ten counts are built on the fast-flux product specifically rather than on hosting in general.

Substantive Wire Fraud Counts 3 to 12 New v2.1

Confirmed Each count pairs one victim with one client conspirator and one piece of Media Land infrastructure. Paragraph 244 states that Volosovik and Zatolokin "controlled and maintained servers in New Jersey and Russia" that transmitted fraudulent responses to ransomware attacks, "including agreements to pay ransoms, receive locker passwords, and other communications related to malware attacks." The recurring New Jersey entry is the ISP1 server hosting ffv2.ru.

The final count is the only one drawing on both autonomous systems together, and it independently corroborates the AS215376 correction. Note also that the wire fraud conspiracy schedule at paragraph 241 records a Media Land IP logging into a Mega.nz account on 24 March 2021 in connection with Client Conspirator 15 and Victim 42, the only named third-party storage service in the document.

Sentencing Enhancement: False Domain Registration New v2.1

Confirmed Neither press release mentions it, but the indictment charges a sentencing enhancement under 18 U.S.C. 3559(g)(1) for knowingly registering domains with false names and addresses "in a manner that prevented the effective identification of and contact with" the defendants, and using them in the course of Counts 1 to 13. Paragraph 253 enumerates roughly 56 such domains, listed in Section 04. These are the highest-value new indicators in the document.

Forfeiture Allegation New v2.1

Confirmed The government seeks forfeiture of all property constituting or derived from proceeds of Count 1, all personal property used or intended to be used to facilitate Count 1, all property traceable to Counts 2 through 12, and all property involved in Count 13 plus anything traceable to it. Authorities cited: 18 U.S.C. 982(a)(2)(B), 1030(i), 981(a)(1)(C), 982(a)(1), and 28 U.S.C. 2461(c). No specific assets, wallets or sums are itemised in the forfeiture paragraph.

Rewards for Justice Offer New in v2

Sanctions Chronology

Server Seizures

Confirmed None against Media Land as of 26 July 2026. This is notable in context: Dutch authorities seized 800 servers from Stark Industries in May 2026 and 127 servers from ZServers/XHost in February 2025, and the Dutch National Police and Public Prosecutor's Office materially assisted the Media Land investigation. Dutch capability, willingness, and case involvement are all established, and Media Land is now confirmed to have had Netherlands infrastructure. The absence of a seizure to date is therefore a choice or a sequencing decision rather than a capability gap, and a Netherlands or Finland action remains a plausible near-term development.

Post-Disruption Client Migration

Confirmed FBI Cyber Division Assistant Director Brett Leatherman stated after the unsealing that the bureau believes Media Land "is likely still shielding criminal activity" and that the FBI is actively monitoring for client migration: "We're looking for that now, to understand where those shifts may be and what opportunities are available to us in law enforcement and in the intelligence community to target those." [19]

Analyst Inference Precedent argues that migration, if it occurs, will be fast and largely successful. After the May 2026 Stark Industries seizure, GreyNoise researchers documented what they characterised as a seamless migration of attack infrastructure to new autonomous systems with near-identical behavioural signatures. The 2023 Genesis Market takedown produced replacement markets within weeks. Media Land's own position is stronger than either of those cases, however, because its core infrastructure has not been seized, so its clients have no forcing event compelling them to move. The pressure on them is reputational and sanctions-derived rather than operational.

Five Eyes Guidance

On 19 November 2025, CISA with US, UK, Australian, Canadian, and New Zealand partners released "Bulletproof Defense: Mitigating Risks from Bulletproof Hosting Providers," advising ISPs to build high-confidence malicious resource block lists, conduct regular traffic analysis, implement know-your-customer verification for new hosting clients, and block traffic from known BPH autonomous system numbers. The guidance was released concurrently with the Media Land sanctions, confirming BPH providers as the primary intended target. [6][8]

Connected Groups and Ecosystem Relationships

Every connected entity claim carries two confidence labels assessed independently. Tier 1 asks whether Media Land hosted the entity's infrastructure. Tier 2 asks whether Media Land operators knew the client's identity and coordinated operationally. These are distinct claims requiring distinct evidence and are never collapsed.

Trajectory Assessment

Infrastructure Churn

Confirmed AS206728 remains fully active. All eight IPv4 prefixes and both IPv6 prefixes are announced, 2,048 IPv4 addresses are originated, and all four observed upstream peers remain in place. No ASN deregistration, prefix withdrawal, transit change, or de-peering has occurred through the November 2025 sanctions, the July 2026 EU designation, or the July 2026 indictment unsealing. No new ASN registrations or new Russian corporate registrations by any principal have been identified. [13]

The contrast with Aeza Group remains instructive and has now widened. Aeza began entity restructuring and infrastructure migration within weeks of its July 2025 designation, prompting a second OFAC action in November 2025 against its front companies. Media Land, sanctioned in four jurisdictions and now criminally charged, has made no observable reconstitution move. Analyst Inference Two readings are available and are not mutually exclusive: the operators assess Russian territorial protection as sufficient and see no need to restructure, or the Russian core of the estate is not portable in the way Aeza's leased capacity was, because DC Kirishi represents owned hardware in a fixed location. The owned-infrastructure model that gave Media Land a commercial edge may also be what makes it least able to run.

Market Position

Media Land occupies the top tier of the Russian BPH market on every available axis: 15+ years of continuous operation, flagship-tier ransomware clientele, owned physical data center capacity, a mature fast-flux product sold as a distinct line, and, per the indictment, concentration of eight major carding marketplaces plus 17 or more criminal groups. The provider has absorbed a public identity exposure in 2019, two damaging leaks in 2025, sanctions in four jurisdictions, and a US criminal indictment without observable operational interruption. That resilience is a property of the jurisdiction, not of the tradecraft.

Disruption History Assessment

Trajectory Direction: DEGRADED and STABLE

Assessment unchanged in direction from v1, with higher confidence and a changed basis. Media Land is assessed as Degraded but operationally stable. Every applied instrument to date has been financial, legal, or reputational; none has touched the infrastructure. The provider retains its ASN, its prefixes, its peers, its owned data center, and its principals.

What changed in v2 is that the disruption ceiling is now higher than v1 assessed. v1 concluded that "physical disruption is not achievable under current conditions given wholly Russia-based infrastructure." That premise was wrong. Infrastructure in the Netherlands, Finland, and the United States is within reach, Dutch authorities are already case participants with demonstrated seizure capability, and a partial seizure action is a realistic near-term possibility. Such an action would not end the provider, whose core is in Russia, but it would remove the multi-jurisdictional redundancy that the indictment identifies as a deliberate resilience feature.

Watch indicators, next 6 to 12 months:

• Seizure or takedown action against Netherlands, Finland, or US-hosted Media Land infrastructure
• New ASN or prefix registrations, or new Russian corporate registrations, by any principal or associate (reconstitution signal)
• Withdrawal of any of the four upstream peers, particularly SYSECT D.O.O. (AS202799, Montenegro)
• Client migration to alternative BPH providers, per the FBI's stated monitoring focus
• Superseding indictment, additional defendants, or added counts, especially any with a state-nexus character
• Any public product of the Rewards for Justice offer
• Travel by any defendant to a jurisdiction with US transfer arrangements
• Russian domestic action, which would be a significant and unexpected departure from the Tier 2 assessment

Mandatory Intelligence Gaps

Recent Reporting

Sources

Revision History and Change Record

Full provenance for every revision of this profile. Retained so that any claim, correction or withdrawal can be traced to the revision that made it and the source that prompted it.