The U.S. Treasury Department has reportedly sanctioned Aeza Group, a Russia-based bulletproof hosting (BPH) service for allegedly aiding cybercriminals to facilitate ransomware campaigns and information theft.
Aeza Group is accused of offering infrastructure, including specialized servers, to support ransomware operators and malware distributors like Meduza and Lumma infostealer operators, the BianLian ransomware gang, RedLine infostealer panels, and the Russian darknet marketplace BlackSprut.
A Tron blockchain wallet address reportedly processed payments and transferred funds to various exchanges.
The Wallet allegedly received payments for Aeza’s services, funneled money through intermediaries, and maintained links to other cybercriminal networks, including the sanctioned Russian exchange Garantex. It also used a crypto payment processor, further complicating efforts to trace client deposits and transactions.
According to the Treasury’s Office of Foreign Assets Control (OFAC), the sanctions target companies, a crypto wallet containing $350,000, and multiple affiliated individuals, including four Russian nationals believed to be board members or part-owners of the group: Arsenii Aleksandrovich Penzev, Yurii Meruzhanovich Bozoyan, Vladimir Vyacheslavovich Gast, and Igor Anatolyevich Knyazev.
Penzev and Bozoyan were reportedly arrested by Russian authorities for alleged involvement with BlackSprut, leaving Knyazev to manage the business.
The sanctions freeze all U.S. linked assets belonging to Aeza and the named individuals. They also prohibit U.S. citizens from engaging in any transactions with them, with potential civil and criminal penalties for violations.
This action resonated with efforts by U.S. and allied governments to dismantle the infrastructure supporting global cybercrime.
Yesterday, the Department of Justice (DOJ) announced criminal charges against four North Korean nationals accused of stealing nearly $1 million in cryptocurrency from blockchain startups in the United States and Serbia.