US OFAC (with UK, Australia) designates Media Land / Aeza Group bulletproof-hosting cybercrime network — 5 individuals, 7 companies across Russia, Serbia, UK, Uzbekistan

Mechanism

OFAC used Executive Order 13694 ("Blocking the Property of Certain Persons Engaging in Significant Malicious Cyber-Enabled Activities") to designate a second wave of entities tied to Russia-based bulletproof-hosting (BPH) provider networks, following its 1 July 2025 designation of Aeza Group. Bulletproof hosters sell server and IP infrastructure specifically engineered to resist takedown requests and law-enforcement subpoenas, making them a persistent enabling layer for ransomware-as-a-service groups (LockBit, BlackSuit, Play) and other cybercrime marketplaces.

This tranche has two distinct threads: 1. Media Land — a standalone Russia-based BPH operator and two of its technical subsidiaries (Media Land Technology, Data Center Kirishi, ML Cloud) designated directly for providing infrastructure to ransomware operators. 2. Aeza evasion network — after Aeza Group's July 2025 designation, its leadership attempted to rebrand and relocate its technical infrastructure outside Russia to break the sanctions nexus. OFAC (with the UK) designated Hypercore Ltd. (UK) as an Aeza front company, and (with input tying to Aeza's operations) Smart Digital Ideas DOO (Serbia) and Datavice MCHJ (Uzbekistan) as material-support entities that helped stand up not-publicly-Aeza-branded infrastructure.

Total scope disclosed by Treasury: 5 individuals and 7 companies designated in this action. Effect under EO 13694: all property and interests in property of designated persons within U.S. jurisdiction are blocked, and U.S. persons are generally prohibited from engaging in transactions with them.

Downstream implications

• Illustrates the "evasion-chasing" pattern now standard in OFAC cyber-sanctions practice:

once a BPH provider is designated, follow-on designations target the rebranded shell entities the sanctioned network stands up in third countries (here UK, Serbia, Uzbekistan) to preserve service continuity.

• Serbia and Uzbekistan appear in the IPTM register here as jurisdictions hosting sanctions-

evasion shell entities rather than as policy issuers — flags both as watch jurisdictions for future BPH/shell-company enforcement actions.

• Ransomware groups (LockBit, BlackSuit, Play) lose one more layer of hosting infrastructure,

likely accelerating the provider-churn cycle documented across the western-russia-sanctions theme's enforcement actions.

Open questions

• Whether Smart Digital Ideas DOO (Serbia) had any independent commercial operations beyond

serving as Aeza infrastructure, which would affect whether Serbian authorities pursue parallel domestic action.

• Whether the UK and Australian designations announced in the same coordinated action carry

an equivalent or narrower entity list than the US OFAC list (this filing tracks the US OFAC action only).