US imposes sanctions on second Russian bulletproof hosting vehicle this year – Source: go.theregister.com

The US Treasury has sanctioned Aeza Group, a Russian bulletproof hosting (BPH) provider, and four of its cronies for enabling ransomware and other cybercriminal activity.

This is the second time this year BPH providers have been hit with sanctions. These organizations claim to offer cybercriminals resources, such as servers and other computer infrastructure, that can’t be disrupted or seized by law enforcement. Aeza Group was one of them — they provided services to big-name ransomware gang BianLian, as well as info-stealing ops like Meduza and Lumma, (Lumma, by the way, just got taken down by the FBI and friends.)

BianLian is a tricky customer that has been around for years, regularly changing tactics and complicating defenders’ attribution efforts. 

Once a key player on the ransomware scene, BianLian as of January 2024 joined the growing number of cybercrime groups abandoning encryption to embrace a data exfiltration-based extortion model.

It is known to target critical infrastructure organizations in the US, and has been fingered for attacks on the likes of nonprofit Save The Children.

The Russia-headquartered Aeza Group also has a UK-registered affiliate, Aeza International, and the National Crime Agency (NCA) helped coordinate the front company’s designation on the US Treasury’s sanctions list.

The sole remaining company director associated with Aeza International is based in Kazakhstan, according to Companies House, but was not included in the personal sanctions imposed on four individuals said to hold leadership positions within the Aeza operation.

The Register asked the NCA for more information about the individual but it declined to comment any further.

Unlike the UK branch frontman, Aeza Group’s three owners and technical director – all Russian nationals – were designated by the Treasury’s Office of Foreign Assets Control (OFAC).

Arsenii Aleksandrovich Penzev, Yurii Meruzhanovich Bozoyan, and Igor Anatolyevich Knyazev – the CEO, general director, and interim boss of Aeza respectively – each own 33 percent of the company.

• UK, US, Oz blast holes in LockBit’s bulletproof hosting provider Zservers
• Gilmore Girls fans nabbed as Eurocops dismantle two major cybercrime forums
• Euro cops arrest 4 including suspected LockBit dev chilling on holiday
• Feds raise alarm over Snatch ransomware as extortion crew brags of Veterans Affairs hit

Penzev and Bozoyan were arrested by Russian police for taking on Blacksprut as a client. Blacksprut is a Russian dark web marketplace that sells illicit substances and has also been accused of money laundering.

Knyazev took over the day-to-day management of Aeza Group while the other two owners dealt with their own legal troubles.

The fourth horseman in the Aeza operation is Vladimir Vyacheslavovich Gast, the company’s technical director who oversaw the Blacksprut deal, although there was no mention of his arrest alongside Penzev and Bozoyan.

Double header

The designation of Aeza Group follows that of Zservers in February, the BPH provider relied upon by former ransomware top dog LockBit.

Zserver and LockBit began working together as far back as 2022, and the sanctions against the BPH company were revealed roughly a year after Operation Cronos took down the ransomware kingpin.

The sanctions issued against the Aeza companies and their key players this week mean anyone caught doing business with Aeza could face civil penalties.

Realistically, it just means US entities can’t do business with Aeza, and since many of the malware operations the company supports are operating out of Russia, the real-world impact of the sanctions may be limited.

Bradley T Smith, acting Under Secretary for Terrorism and Financial Intelligence, said OFAC would continue to target players in the BPH space.

“Cybercriminals continue to rely heavily on BPH service providers like Aeza Group to facilitate disruptive ransomware attacks, steal US technology, and sell black-market drugs,” he said.

“Treasury, in close coordination with the UK and our other international partners, remains resolved to expose the critical nodes, infrastructure, and individuals that underpin this criminal ecosystem.” ®