Australia, U.S., and U.K. Sanction Russian Cybercrime Infrastructure and Crypto Laundering Network

In an allied show of cooperation against cybercrime, the governments of the U.S., Australia and UK have sanctioned a network of Russian-based ‘bulletproof’ hosting providers, and a Bitcoin address associated with a leader behind the businesses.

The hosting companies subject to the trilateral sanctions include Media Land LLC and ML. Cloud LLC, and two senior employees behind the ventures — Aleksandr Alexandrovich Volosovik and Kirill Andreevich Zatolokin.

“These so-called bulletproof hosting service providers like Media Land provide cybercriminals essential services to aid them in attacking businesses in the United States and in allied countries,” said U.S. Under Secretary of the Treasury for Terrorism and Financial Intelligence John K. Hurley.

Bulletproof hosting providers knowingly help cybercriminals lease infrastructure to host illegal content or run their shady online dealings and scams, and ignore law enforcement, takedown requests or complaints. Sanctions make it illegal to make assets available to a designated person or entity, or to deal with any assets owned or controlled by them — effectively freezing them. 

Related: Scammers Exploit Australia’s Cybercrime Hotline to Impersonate Police and Steal Crypto

The sanctions mark the fifth time the Department of Foreign Affairs and Trade (DFAT) has activated Australia’s autonomous cyber sanctions framework. Deputy Prime Minister and Minister for Defence Richard Marles said the effort would help reduce malicious cyber activity and defend our national security.

These sanctions don’t just impose costs on criminals, they dismantle the infrastructure that enables cybercrime. By disrupting these networks, we make it harder for others to launch attacks and it strengthens Australia’s resilience against future threats.

Richard Marles, Australian Deputy Prime Minister

In adding Volosovik — also known as Yalishanda — to its ‘Specially Designated Nationals List’, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) also included one Bitcoin address connected to him (XBT 18dLDAWi8LmrHbEq3QzDJb9SLxCf4uimXB).

However, on-chain data analytics firm Chainalysis reported it was “monitoring thousands of addresses and millions of dollars worth of cryptocurrency transactions attributed to Yalishanda and his enterprises.”

Chainalysis said the Russian’s hosting services underpinned almost every step involved in carrying out a cyber attack, and were being leveraged by underground exchanges, laundering-as-a-service providers, scammers, hackers, individuals selling access and malware-as-a-service, and ransomware operators. This includes sanctioned Lockbit ransomware administrator, Dmitry Khoroshev, AKA Lockbitsupp.

Related: Australian Energy Assets Caught in $700 Million Crypto Dispute as Techteryx Wins Global Freeze

Additional U.S. Treasury Sanctions Target Crypto-Enabled Money Laundering 

In a separate action announced by OFAC on November 19, the U.S. also designated former Canadian Olympian and current FBI most-wanted fugitive Ryan James Wedding, along with a number of associated individuals and entities. Included in the sanctions listing were multiple crypto wallet addresses linked to Bitcoin, Ethereum, Tron, and Solana. 

Under Secretary of the Treasury for Terrorism and Financial Intelligence John K. Hurley described Wedding as “one of the most notorious criminals and narcotraffickers still evading justice.”

U.S. Treasury said Wedding’s criminal gang used crypto to move and launder his drug trafficking profits. Sanctions against Wedding and nine of his associates are designed to cut off the drug trafficker from the U.S. financial system to help dismantle his networks. Criminal indictments were also issued for Wedding and his network by the U.S. Attorney’s Office for the Central District of California.