Fast Facts

• The UK sanctioned Alexander Volosovik, Russia-based operator of bulletproof hosting firms Media Land LLC and ML.Cloud LLC.
• Volosovik’s infrastructure supported notorious ransomware gangs like LockBit, Evil Corp, and BlackBasta.
• Bulletproof hosting services resist law enforcement takedowns and shield cybercriminals’ identities.
• International action included server seizures and industry alerts across the UK, US, Australia, and Netherlands.
• Ransomware attacks enabled by these services have crippled sectors from finance to critical infrastructure worldwide.

The Web’s Underworld: Where Cybercrime Finds Sanctuary

Picture a digital fortress-a sprawling, shadowy data center that shrugs off police raids and ignores pleas from victims. This is the domain of “bulletproof” hosting, a clandestine industry that rents out online hideouts to the world’s most dangerous cybercriminals. When ransomware gangs strike, their attacks are often launched from these hidden servers, making them nearly impossible to trace or shut down.

The Man Behind the Curtain: Alexander Volosovik

This week, the UK’s National Crime Agency (NCA) unmasked Alexander Volosovik-known by aliases like “Yalishanda” and “Downlow”-as one of the globe’s most prolific bulletproof hosting operators. Running Media Land LLC and ML.Cloud LLC out of Russia, Volosovik built a business that quietly propped up infamous ransomware crews such as LockBit and Evil Corp, as well as black markets and even controversial forums like 8chan (now 8kun).

Cybersecurity journalist Brian Krebs previously dubbed Volosovik the “world’s biggest bulletproof hosting operator.” His companies specialized in renting digital safehouses that ignored abuse reports and shielded clients’ identities, making them a go-to resource for online criminals seeking impunity.

How Bulletproof Hosting Empowers Ransomware

Unlike regular web hosts, bulletproof providers are like landlords who not only ignore what tenants do but actively help them dodge eviction. They design their networks to resist takedowns, route traffic through obscure channels, and never ask for real names. This makes it far harder for police and security researchers to dismantle cybercrime operations at their roots.

Ransomware attacks-where hackers lock up an organization’s data and demand payment-have surged in recent years, with groups like LockBit and BlackBasta raking in millions. These gangs rely on bulletproof infrastructure to launch attacks, host stolen data, and communicate with victims, all while staying hidden from law enforcement. The notorious 8chan forum’s return after a global deplatforming campaign, enabled by Volosovik’s servers, is just one example of the industry’s resilience.

Cracking Down: Sanctions and Seizures

Recognizing the strategic importance of these enablers, the UK, US, and Australia imposed sanctions on Volosovik and his associates, freezing assets and warning the tech industry about the risks of bulletproof hosts like Media Land and AEZA. In a separate Dutch operation, police seized 250 servers linked to over 80 cybercrime investigations, exposing the machinery behind countless attacks.

These moves form part of a wider shift: rather than just chasing individual hackers, authorities are targeting the infrastructure that makes cybercrime scalable and persistent. As Paul Foster of the NCA put it, cutting off these digital sanctuaries is key to weakening the criminal ecosystem.

WIKICROOK

• Bulletproof Hosting: Bulletproof hosting is a web hosting service that ignores abuse reports, letting criminals host illegal or malicious content with little risk of takedown.
• Ransomware: Ransomware is malicious software that encrypts or locks data, demanding payment from victims to restore access to their files or systems.
• Sanctions: Sanctions are government-imposed restrictions that block financial activities and assets to punish or deter illegal, unethical, or dangerous behavior.
• VPS (Virtual Private Server): A VPS (Virtual Private Server) is a rented virtual server offering dedicated resources, reliability, and control, ideal for hosting websites and applications.
• Five Eyes: The Five Eyes is an alliance of the US, UK, Canada, Australia, and New Zealand for sharing intelligence and cyber threat information.