OFAC Sanctions Russian Hosting Provider for Enabling Crypto Theft

On Tuesday, the U.S. Department of the Treasury’s Office of Foreign Assets Control sanctioned Russian bulletproof hosting provider Aeza Group for facilitating cybercriminal activity, including ransomware attacks and darknet drug markets that targeted victims worldwide, including in the U.S.

“Cybercriminals continue to rely heavily on BPH service providers like Aeza Group to facilitate disruptive ransomware attacks, steal U.S. technology, and sell black-market drugs,” Acting Under Secretary of the Treasury for Terrorism and Financial Intelligence Bradley T. Smith said in a statement.

Bulletproof hosting providers offer technical infrastructure—such as servers and domains—that are resistant to law enforcement takedowns, allowing cybercriminals to operate with impunity. The services are critical enablers for ransomware operators, credential stealers, and illicit marketplaces.

According to blockchain intelligence firm TRM Labs, OFAC’s action included the designation of a crypto address tied to Aeza Group that has received over $350,000 in funds. 

The wallet displays links to the sanctioned exchange Garantex, as well as other cybercrime services, with regular cashouts to global crypto platforms. The Secret Service seized Garantex in March this year.

Aeza Group, based in St. Petersburg, Russia, has hosted infrastructure for ransomware groups, such as BianLian, and infostealer operations, including Meduza and Lumma.

It also supported RedLine infostealer panels and the notorious darknet drug marketplace Blacksprut, which traffics narcotics globally, including into the U.S.

The Treasury said Aeza Group’s leadership team included CEO Arsenii Penzev and General Director Yurii Bozoyan, both of whom were previously arrested by Russian authorities for hosting drug marketplaces. 

Technical Director Vladimir Gast and part-owner Igor Knyazev were also named in the designations.

OFAC also sanctioned three affiliated entities: the U.K.-based Aeza International Ltd. and its Russian subsidiaries, Aeza Logistic LLC and Cloud Solutions LLC.

The sanctions block all property and interests of the designated parties within the U.S. or under the control of U.S. persons. U.S. entities are generally prohibited from conducting transactions involving those named, and violations may result in civil or criminal penalties.

Edited by Sebastian Sinclair