CLEVELAND – The U.S. Attorney’s Office for the Northern District of Ohio has announced the unsealing of an indictment charging three Russian nationals for their roles in malicious cyber activities against U.S. critical infrastructure affecting victims in 21 states and in several countries, with losses amounting to tens of millions of dollars. These charges are the result of a seven-year-long investigation. A federal grand jury returned an indictment in December 2024 charging the following defendants with Conspiracy to Commit and Aid and Abet Computer Fraud, Conspiracy to Commit Wire Fraud, Wire Fraud, and Conspiracy to Commit Money Laundering:Alexander Alexandrovich Volosovik, 43, of St.
Petersburg, RussiaKirill Andreevich Zatolokin, 34, of St. Petersburg, RussiaYulia Vladimirovna Pankova, 29, of St. Petersburg, RussiaMedia Land, LLC, headquartered in St. Petersburg, RussiaML.Cloud, LLC, headquartered in St.
Petersburg, RussiaIn addition to the unsealing of the indictment, the U.S. Department of State’s Rewards for Justice (RFJ) program announced today that it is offering a reward of up to $10 million and possible relocation for actionable information on foreign government-linked associates of Pankova, Volosovik and Zatolokin, their malicious cyber activities, or foreign government-linked use of Media Land or ML.Cloud. U.S. sanctions were announced in November 2025 against the indicted defendants and companies. “From their overseas haven, these defendants ran the criminal infrastructure that powered attacks on critical institutions across our nation,” said Assistant Attorney General A.
Tysen Duva of the Justice Department’s Criminal Division. “Their actions put the American public at risk. We will continue to dismantle these networks and protect our critical infrastructure from cybercriminals at home and abroad.”"The victims in this case are not only in Ohio, but also in 20 other states across the country, touching every aspect of Americans’ lives. They include banks, schools, government entities, hospitals, and media companies,” said United States Attorney David M.
Toepfer for the Northern District of Ohio. “Together with our international partners, we will aggressively combat the efforts of individuals who hide behind computers anywhere in the world who seek to profit and wreak havoc by targeting the infrastructures that support our communities.”“With today’s actions, the FBI and our partners are striking at the core services that cybercriminals rely on to attack U.S. critical infrastructure,” said Assistant Director Brett Leatherman of FBI Cyber Division. “Media Land has enabled malicious activity causing tens of millions in losses and impacting victims across 21 states and multiple countries. This is another step in our broader campaign to shrink the space in which these actors can operate, forcing them to work harder, take greater risks, and lose the anonymity they depend on.”According to allegations in court documents, Media Land, LLC, owned by Volosovik, and ML.Cloud, owned by Pankova, at the time of investigation and indictment, were both based in St.
Petersburg and provided infrastructure for computer servers and related internet services. Media Land’s infrastructure also operated out of multiple countries including China, Finland, the Netherlands, and the United States. These businesses provided what are known as “bulletproof hosting” services for client users to not only conduct criminal activities, but also to evade detection by law enforcement. Such businesses knowingly and intentionally market and/or lease their infrastructure to cybercriminals.
According to the indictment, Media Land and ML.Cloud provided infrastructure and tech support to criminal client co-conspirators with the means to infect victim computers with malware and ransomware and then extorted those victims for money and cryptocurrency. Other computer-based crimes facilitated by Media Land and ML.Cloud included supporting criminal marketplaces, fraudulent domain registrations, and providing the platform from which to launch phishing and brute force attacks.“Today’s announcement underscores the importance of global partnerships and international collaboration, especially in a borderless world riddled with cyber criminals,” said FBI Cleveland Special Agent in Charge Josh DelManzo. “The methods used by these bad actors, including ransomware, malware, phishing and other cyber activity, serves as a reminder that whether for business or personal use, when you are online, criminal networks will stop at nothing to hack, attack, share, or sell your information for their own greed, gain, and profit. The FBI and its partners will continue to identify and cripple criminal networks and freeze their infrastructures to reduce or remove the threats to the public and further protect trusting individuals and companies.”“The Department of State is committed to countering malicious cyber activities that threaten U.S. critical infrastructure and our national security,” said Deputy Assistant Secretary and Assistant Director of the U.S.
Department of State’s Diplomatic Security Service for Cyber & Technology Security Gharun Lacy. “We remain relentless in our efforts to generate information that helps our law enforcement partners disrupt campaigns against our national interest and bring these malicious cyber actors to justice.”Investigators found that dozens of victim organizations were targeted by criminal groups who used Media Land’s and ML.Cloud’s services. Victim entities included banks, schools, government entities, hospitals, and media companies. The victims were located throughout the U.S. and across the world.
In the Northern District of Ohio, victims were located in: Akron, Brookfield, Canton, Cleveland, Elyria, Medina, Findlay, Solon, and Valley View. At least 20 other states were also affected including: California, Delaware, Florida, Georgia, Illinois, Louisiana, Maryland, Massachusetts, Michigan, Minnesota, New Hampshire, New York, North Carolina, Pennsylvania, Tennessee, Texas, Utah, Virginia, Washington state, and Wisconsin. International victims were located in Australia, the European Union, the United Arab Emirates, Canada and the United Kingdom.“Cybercriminals persist in their efforts to disrupt networks and systems while remaining undetectable and difficult to trace. Bulletproof hosting providers are increasingly becoming common accomplices, posing an imminent and significant risk to the resilience and safety of critical systems and services,” said CISA Industry Team Operations Manager, Nicholas Colella.
“CISA’s global collaboration with governments, law enforcement, and the private sector is making it harder for cybercriminals to remain anonymous online. Our joint BulletProof Defense guide provides actionable information to reduce the effectiveness of this nefarious infrastructure and risk to this threat.”Anyone with information should contact Rewards for Justice via its Tor-based tips-reporting channel at: he5dybnt7sr6cm32xt77pazmtm65flqy6irivtflruqfc5ep7eiodiad.onion (Tor browser required).More information is available on the RFJ website at RewardsForJustice.net. Rewards for Justice Rewards for Justice In November 2025, the Department of the Treasury’s Office of Foreign Assets Control, joined by the United Kingdom’s Foreign Commonwealth and Development Office and Australia’s Department of Foreign Affairs and Trade, designated Media Land as a Specially Designated National (SDN) for facilitating global ransomware operations, DDoS attacks, and malicious cyber activities. The sanctions block all U.S. property and prohibit transactions by U.S. persons.
Volosovik, Zatolokin, and Pankova were individually sanctioned. Media Land subsidiaries Media Land Technology (MLT) and Data Center Kirishi (DC Kirishi) along with Media Land’s sister company, ML Cloud were also sanctioned. On July 13, the European Union also announced sanctions as a crucial step in the international fight against cybercrime.This investigation is being led by the FBI Cleveland Division, with the assistance of the Cybersecurity/Infrastructure Security Agency (CISA), and the Office of Foreign Assets Control (OFAC).U.S. Attorney Toepfer would like to acknowledge the valuable assistance of the following agencies in this investigation:National Police of the NetherlandsPublic Prosecutor's Office of the NetherlandsUnited Kingdom’s National Crime AgencyUnited Kingdom Foreign Commonwealth and Development OfficeAustralian Department of Foreign Affairs and TradeAustralian Federal PoliceThe prosecution in this case is being led Assistant United States Attorney Duncan T.
Brown for the Northern District of Ohio and Trial Attorney Christen Gallagher of the Criminal Division’s Computer Crime and Intellectual Property Section (CCIPS).Additional Partner StatementsAustralian Federal Police“The AFP welcomes and supports the United States’ Department of Justice announcement on the indictment on the principal Media Land operator, Aleksandr Alexandrovich Volosovik – also known as Yalishanda,” AFP Assistant Commissioner Cyber and Special Investigations Sandra Booth said. “AFP’s cooperation with partner law enforcement agencies in the United States and internationally is critical in disrupting criminal activity. The AFP remains committed to continuing its relentless work to target cybercriminals.””Bulletproof hosting enables cybercriminal activity including ransomware, scams, malware infections, and other malicious offending that harms people online in Australia and overseas. “The disruption and removal of bulletproof hosts is a vital step to prevent cybercriminals who prey on the victims online.”National Police and Public Prosecutor’s Office of the NetherlandsPolice and Public Prosecution Service: New EU sanctions crucial step in international fight against cybercrime“The Netherlands Police and Public Prosecution Service welcome the EU sanctions that were imposed on two Russian companies, the CEO of these companies, and another key player in organised cybercrime.
The sanctions were introduced to make it harder for cyber criminals to continue their activities, and to disrupt their criminal business model.”United Kingdom National Crime AgencyThe National Crime Agency welcomes today’s action against the key operators behind the bulletproof hosting service Media Land AKA Yalishanda.Deputy Director Paul Foster, National Cyber Crime Unit, said “Working together across borders is essential to dismantling the infrastructure that enables serious cybercrime. This action reflects the strength of close collaboration between international partners to identify, disrupt, and bring cybercriminals to justice. Bulletproof hosting forms a critical part of the cybercriminal ecosystem, providing resilient infrastructure that facilitates ransomware, phishing, malware and other serious offences. Continued action against these key enablers is essential to reducing their resilience, disrupting the services cybercriminals depend on, and increasing the cost and risk of cybercrime.” filed_indictment.pdf