Federal prosecutors unsealed charges against three Russian nationals accused of running a St. Petersburg hosting operation that gave ransomware gangs cover to hit American hospitals, schools and banks, costing victims more than $62 million.
The Justice Department on Tuesday unsealed an indictment charging Alexander Volosovik, 43, Kirill Zatolokin, 34, and Yulia Pankova, 29, along with their companies Media Land LLC and ML.Cloud LLC, with running what investigators call a bulletproof hosting service. Prosecutors say the operation knowingly rented server infrastructure to some of the world's most damaging ransomware crews, including LockBit, BlackSuit and Play, and shielded them from law enforcement while their clients extorted victims across 21 states.
The indictment, filed under seal in the Northern District of Ohio in December 2024, describes a business built to keep criminals online no matter who came looking. Volosovik owned Media Land. Pankova owned ML.Cloud. Zatolokin worked alongside them. Together, prosecutors say, the trio maintained servers not just in Russia but in China, Finland, the Netherlands and the United States, giving ransomware operators a resilient backbone that could survive takedown attempts in any single country.
Bulletproof hosts do not write the malware or send the ransom notes. They rent the pipes. That distinction has let firms like Media Land operate for years while the gangs renting their servers grabbed the headlines. This indictment treats the landlord the same as the tenant, charging the defendants with conspiracy to commit computer fraud, wire fraud and money laundering for the infrastructure they say made the attacks possible.
The Justice Department says the scheme touched at least 44 identified victims, among them hospitals, school districts, banks and media companies, with losses topping $62 million. Northeast Ohio institutions were among those hit, according to the U.S. Attorney's Office for the Northern District of Ohio, which brought the case alongside the FBI's Cleveland field office. Acting U.S. Attorney officials in Cleveland framed the case as a direct hit on the infrastructure that keeps ransomware gangs in business, not just another arrest of a single hacker.
The State Department's Rewards for Justice program is now offering up to $10 million, and possible relocation, for information leading to the arrest or conviction of the three defendants or identifying foreign government ties to their operation. That bounty is a signal in itself: none of the three are in custody, and all signs point to them remaining in Russia, well outside the reach of American courts unless Moscow ever chooses to cooperate, which it has shown no interest in doing.
A case built two years before it went public
The indictment sat sealed for roughly a year and a half before prosecutors made it public this week. The Justice Department has not detailed publicly why the timing shifted now, and PRN has reached out to the department's Office of Public Affairs for comment on what prompted the unsealing and on the current whereabouts of the defendants. Sealed indictments are typically held back while investigators build parallel cases, coordinate with international partners, or wait for an arrest opportunity that may never come when the accused are based in an adversarial country.
Whatever the reason for the delay, the case lands as the Trump administration has made prosecuting foreign cybercriminals a visible piece of its national security agenda, pairing indictments with sanctions and reward offers designed to squeeze the infrastructure around ransomware even when arrests are unlikely. Bulletproof hosting has become one of the quiet enablers of the ransomware economy, and prosecutors going after the hosts rather than only the hackers who rent from them marks a shift in strategy toward choking off the supply chain criminals depend on.
Volosovik, Zatolokin and Pankova are unlikely to see the inside of an American courtroom anytime soon. But the indictment puts their names, their companies and their alleged client list on the public record, and it puts a price on their capture. Whether that pressure ever produces an arrest, or simply forces Media Land's remaining infrastructure further underground, is the next thing to watch.
Also read: Hegseth and DOJ launch task force to hunt down Pentagon leakers • Zelensky ousts Ukraine's prime minister as Kyiv shifts strategy • Sen. Lindsey Graham dies at 71 after brief and sudden illness
