iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
On July 1, 2025, the U.S. Treasury Department’s Office of Foreign Assets Control (OFAC) designated Russia-based Aeza Group under Executive Order 13694, as amended. Treasury said Aeza provided “bulletproof hosting” to operators associated with the Meduza and Lumma infostealers, BianLian ransomware and RedLine infostealer panels, and hosted the BlackSprut illicit-drug marketplace.
The action also named Aeza affiliates, four company leaders and a United Kingdom front company. The allegations and sanctions consequences below are Treasury’s statements; they are not an independent technical verification of Aeza’s infrastructure.
What the United States announced
Treasury’s July 1, 2025 release, “Treasury Sanctions Global Bulletproof Hosting Service Enabling Cybercriminals and Technology Theft”, identified Aeza Group as headquartered in St. Petersburg, Russia. OFAC designated the group and related parties for allegedly enabling cybercrime infrastructure and technology theft.
Recommended Free Tools
Bradley T. Smith, then Acting Under Secretary of the Treasury for Terrorism and Financial Intelligence, said: “Cybercriminals continue to rely heavily on BPH service providers like Aeza Group to facilitate disruptive ransomware attacks, steal U.S. technology, and sell black-market drugs.” That is Treasury’s characterization of the threat and rationale, not an independent quantitative assessment.
#1 Best Overall
Who was named
| Party | Treasury’s description |
|---|---|
| Aeza Group | Russia-based bulletproof-hosting provider headquartered in St. Petersburg. |
| Aeza International Ltd. | United Kingdom branch that Treasury said leased IP addresses to cybercriminals, including Meduza operators. |
| Aeza Logistic LLC | Russia-based subsidiary described as 100% owned by Aeza Group. |
| Cloud Solutions LLC | Russia-based subsidiary described as 100% owned by Aeza Group. |
| Arsenii Aleksandrovich Penzev | CEO and 33% owner, according to Treasury. |
| Yurii Meruzhanovich Bozoyan | General director and 33% owner, according to Treasury. |
| Vladimir Vyacheslavovich Gast | Technical director. |
| Igor Anatolyevich Knyazev | 33% owner. |
Treasury identified the four individuals as leaders, officials, senior executive officers or board members of Aeza Group. The three 33% ownership figures are ownership details reported in the designation release, not estimates about the wider company or market.
What Treasury alleged Aeza hosted
Infostealer operations
Treasury associated Aeza’s hosting with Meduza and Lumma infostealer operators and said those operators targeted the U.S. defense industrial base and technology companies, among other victims globally. It also said Aeza hosted RedLine infostealer panels.
Infostealers matter because they are designed to collect information that can be reused in later crimes. In an October 29, 2024 announcement about RedLine and META, the U.S. Department of Justice said infostealers can take usernames and passwords, financial and system information, browser cookies and cryptocurrency-account data. Criminals sell the resulting “logs” on underground forums for further fraud and attacks. Stolen authentication cookies and system information can also help attackers bypass multifactor authentication.
Free tools Windows power users keep installed
One-click scans. No signup required.
Ransomware infrastructure
Treasury said Aeza hosted BianLian ransomware. The designation does not provide a victim-loss total or a quantitative estimate specific to Aeza, so figures from unrelated ransomware cases should not be attributed to this action.
BlackSprut marketplace
The release also said Aeza hosted BlackSprut, an illicit-drug marketplace. This allegation was part of Treasury’s stated basis for the designation alongside the cybercrime infrastructure claims.
What “bulletproof hosting” means here
Treasury uses “bulletproof hosting” (BPH) for infrastructure providers that supply servers, IP addresses or related services intended to help malicious users evade detection and resist disruption. In its account, Aeza’s services gave cybercriminal groups hosting and network resources that could remain available despite abuse reports or enforcement pressure.
Rank #4
That definition describes the government’s explanation of the alleged business model. The available announcement does not independently test Aeza’s systems or establish how every named operation used the service.
What the sanctions do
Treasury said property and interests in property of designated or otherwise blocked persons that are in the United States, or in the possession or control of U.S. persons, are blocked and must be reported to OFAC. U.S. persons generally may not transact in that blocked property or in the property interests of blocked persons unless an OFAC license or an exemption applies.
Best Value
Treasury also summarized OFAC’s 50 Percent Rule: entities owned 50% or more, directly or indirectly, individually or in aggregate, by one or more blocked persons are themselves blocked even if they are not separately named.
- The rules can affect payments, accounts, contracts and other property interests involving a blocked party.
- They apply to U.S. persons and property within U.S. jurisdiction under the conditions described by OFAC.
- A specific transaction may depend on current licenses, exemptions, ownership facts and later amendments; this summary is not legal advice.
Is Aeza still on the sanctions list?
The July 2025 announcement establishes what Treasury designated at that time. It does not establish the live status of every named party on September 27, 2026. Before making a present-tense claim that Aeza Group, an affiliate or an individual remains listed, check OFAC’s current Specially Designated Nationals and Blocked Persons material and any subsequent notices.
Why the Aeza action followed another hoster case
On February 11, 2025, the United States, Australia and the United Kingdom announced a separate action against Zservers, a Russian bulletproof-hosting provider that Treasury said supported LockBit ransomware. The joint release is available from the U.S. Treasury.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Action | Date | Stated focus |
|---|---|---|
| Zservers | February 11, 2025 | Infrastructure supporting LockBit ransomware; coordinated U.S., Australian and UK action. |
| Aeza Group | July 1, 2025 | Alleged hosting linked to Meduza and Lumma infostealers, BianLian ransomware, RedLine panels and BlackSprut. |
The two actions show a continuing enforcement focus on service providers that allegedly supply resilient infrastructure to cybercrime groups. They concern different providers, dates and named operations.
Quick Recap
What this means for defenders and organizations
- Credential theft can become an entry point. Infostealer logs may expose passwords, cookies, financial data and system details that enable account takeover or follow-on attacks.
- Hosting is part of the attack chain. Disrupting infrastructure providers can affect command panels, malware distribution and other services used by criminal groups, even when the provider is not the malware author.
- Sanctions screening is time-sensitive. Organizations dealing with hosting, IP leasing, cloud services or intermediaries should use current OFAC data and assess ownership, licensing and jurisdiction with qualified counsel.
- Do not infer unproven scope. Treasury’s release does not establish that every Aeza customer was criminal, nor does it quantify all victims or losses.
Sources
- U.S. Treasury: Treasury Sanctions Global Bulletproof Hosting Service Enabling Cybercriminals and Technology Theft (July 1, 2025)
- U.S. Treasury: United States, Australia, and the United Kingdom Jointly Sanction Key Infrastructure that Enables Ransomware Attacks (February 11, 2025)
- U.S. Department of Justice: U.S. Joins International Action Against RedLine and META Infostealers (October 29, 2024)
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
