US OFAC designates Aeza Group bulletproof-hosting provider, 2 affiliates, 4 individuals, and UK front company

Mechanism

OFAC designated Aeza Group, a bulletproof-hosting (BPH) services provider headquartered in St. Petersburg, Russia, under Executive Order 13694 (as further amended by E.O. 14144 and E.O. 14306) for cyber-enabled activity that materially contributed to threats against U.S. national security, economic health, and financial stability. BPH providers sell server and IP infrastructure engineered to help cybercriminals evade detection and resist law-enforcement disruption.

Aeza Group hosted infrastructure for the Meduza and Lumma infostealer operations (which targeted the U.S. defense industrial base and technology companies), BianLian ransomware, RedLine infostealer panels, and BlackSprut — a Russian darknet marketplace used to traffic narcotics, including fentanyl precursor chemicals, into the United States.

The designation covers, per the primary Treasury press release:

• Aeza Group itself
• Two affiliated companies (Aeza Logistic LLC, Cloud Solutions LLC)
• Four Aeza Group leaders: Arsenii Aleksandrovich Penzev (CEO, 33% owner), Yuri Meruzhanovich

Bozoyan (general director, 33% owner), Vladimir Vyacheslavovich Gast (technical director), and Igor Anatolyevich Knyazev (33% owner)

• Aeza International Ltd., a UK-registered front company Aeza used to lease IP addresses to

cybercriminals — designated in coordination with the UK National Crime Agency

Treasury frames the action as building on its February 2025 designation of ZServers, another Russia-based BPH provider, signaling a sustained OFAC campaign against the BPH layer of the cybercrime ecosystem.

Downstream implications

• Established the precedent this register's 2025-11-19 filing (2025-11-19-us-ofac-media-land-aeza-cybercrime-infrastructure-sanctions)

documents: Aeza's leadership subsequently attempted to evade this designation by rebranding infrastructure through Hypercore Ltd. (UK), Smart Digital Ideas DOO (Serbia), and Datavice MCHJ (Uzbekistan) — all three were designated in the November follow-up action.

• Part of a pattern of sequential OFAC BPH-provider designations (ZServers Feb 2025 → Aeza

Group Jul 2025 → Media Land/Aeza evasion network Nov 2025) targeting the infrastructure layer underlying ransomware-as-a-service rather than the ransomware operators themselves.

• UK coordination (NCA designating the Aeza International Ltd. front company alongside OFAC)

is a template for allied action against BPH providers using third-country shell entities.

Open questions

• Whether the two affiliated companies (Aeza Logistic LLC, Cloud Solutions LLC) had any

legitimate commercial operations distinct from supporting Aeza's BPH infrastructure.

• Whether the February 2025 ZServers designation this action "builds on" is itself in the

IPTM register (not yet confirmed as of this filing).