U.S. Sanctions on Aeza Group Target the Backbone of Cybercrime Infrastructure

The Aeza Group, a prominent bulletproof hosting provider headquartered in St. Petersburg, Russia, has come under U.S. Treasury sanctions for providing resilient infrastructure to some of the most notorious cybercriminal groups.

Aeza’s services have enabled ransomware operators, infostealer campaigns, and illicit marketplaces to evade law enforcement and continue targeting U.S. defense, technology companies, and victims globally.

Sanctions Extend to Subsidiaries and Leadership

The sanctions, coordinated with the United Kingdom, target not only Aeza Group LLC but also its UK-based front company, Aeza International Ltd., as well as Russian subsidiaries Aeza Logistic LLC and Cloud Solutions LLC.

Four key individuals, CEO Arsenii Aleksandrovich Penzev, General Director Yurii Meruzhanovich Bozoyan, Technical Director Vladimir Vyacheslavovich Gast, and part-owner Igor Anatolyevich Knyazev, have also been designated for their roles in managing and operating Aeza’s criminal infrastructure.

Did you know?
Arsenii Penzev, CEO of Aeza Group, was arrested in Russia in April 2025 for allegedly running a criminal organization and hosting the BlackSprut darknet drug marketplace, highlighting the deep ties between bulletproof hosting and multiple layers of cybercrime.

Bulletproof Hosting: The Hidden Engine of Cybercrime

Bulletproof hosting services like Aeza Group are distinct from ordinary web hosts. They deliberately ignore abuse reports, resist takedown requests, and often operate in jurisdictions with weak enforcement, making them a haven for cybercriminals.

Aeza’s infrastructure has hosted ransomware groups such as Meduza and BianLian, infostealer operators including Lumma and RedLine, and even the notorious BlackSprut darknet drug marketplace.

ALSO READ | Social Engineering Evolves as Hackers Leverage PDFs and Callback Tactics

International Collaboration Intensifies Pressure on Cybercrime Enablers

These sanctions mark a significant escalation in international efforts to dismantle the infrastructure supporting global cybercrime. The U.S. Treasury’s Office of Foreign Assets Control, working closely with the UK’s National Crime Agency, is targeting not only the technical nodes but also the individuals and corporate structures that allow cybercriminals to operate with impunity.

The coordinated action follows similar measures earlier this year against other Russian bulletproof hosting providers, signaling a broader crackdown on the ransomware supply chain.

Impact and Future Implications for Cybercrime Ecosystems

With all property and interests of Aeza Group and its affiliates now blocked in the U.S., and severe penalties for those engaging in transactions with them, the operational landscape for cybercriminals is shifting.

While bulletproof hosts have long been the backbone of ransomware and dark web operations, the growing international resolve to expose and disrupt these enablers could force threat actors to seek new, less resilient infrastructure.

The sanctions also serve as a warning to other service providers who knowingly support cybercrime, as global law enforcement is tightening its grip.