UK Sanctions Russian Cybercrime Group Media Land and Ringleader Alexander Volosovik
Summary
The UK, in coordination with the US and Australia, has imposed sanctions on Media Land LLC, ML.CLOUD LLC, Aeza Group LLC, and four individuals including ringleader Alexander Volosovik (aka Yalishanda) for providing 'bulletproof' hosting services that enable ransomware, phishing, and malware attacks against UK businesses. The coordinated action, announced by Foreign Secretary Yvette Cooper, targets infrastructure that cybercriminals use to operate with impunity. Volosovik is linked to notorious groups including Evil Corp, LockBit, and Black Basta.
“Cyber criminals hiding behind Media Land's services are responsible for ransomware attacks against the UK which pose a pernicious and indiscriminate threat with economic and societal cost, as well as malware and phishing campaigns.”
UK financial sanctions against Media Land and associated entities create immediate screening and blocking obligations for all UK businesses subject to the UK sanctions regime. Entities should verify that sanctions-screening systems flag all seven designations by name and by alias (including Volosovik's 'Yalishanda' moniker) and assess whether any indirect exposure exists through upstream infrastructure providers or business counterparties with ties to bulletproof hosting services.
What changed
The UK has added seven designations to the UK sanctions list: three companies (Media Land LLC, ML.CLOUD LLC, Aeza Group LLC) and four individuals (Alexander Volosovik, Yulia Pankova, Kirill Zatolokin, Andrei Kozlov). Media Land operated bulletproof hosting infrastructure used by ransomware and phishing operators, while Aeza Group also supported Social Design Agency, a Russian disinformation entity. Alexander Volosovik, active since 2010 and linked to Evil Corp, LockBit, and Black Basta, is named as the primary ringleader.
UK businesses and financial institutions subject to financial sanctions regulations must immediately update screening systems to detect and block these designations. Any ongoing business relationships with the sanctioned entities must be terminated or reported to OFSI. The coordinated trilateral action with the US and Australia signals intensified scrutiny of Russian cybercrime infrastructure, and entities operating in sectors historically targeted by ransomware operators (financial services, critical infrastructure, professional services) should treat this as a priority compliance review trigger.
What to do next
- Businesses should review sanctions screening procedures to ensure Media Land LLC, ML.CLOUD LLC, Aeza Group LLC, Alexander Volosovik, Yulia Pankova, Kirill Zatolokin, and Andrei Kozlov are correctly flagged and blocked
Archived snapshot
Apr 20, 2026GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.
Press release
UK smashes Russian cybercrime networks responsible for attacks on UK businesses
The UK, US and Australia announce new sanctions targeting Media Land, a Russian cyber crime group providing so-called 'bulletproof' hosting services.
From: Foreign, Commonwealth & Development Office, National Crime Agency and The Rt Hon Yvette Cooper MP Published 19 November 2025
- New sanctions target the Media Land cybercrime syndicate responsible for facilitating cyber-attacks on UK-based companies.
- Foreign Secretary announces latest crack down on illicit cyber activity globally, as cyber-attacks cost the UK economy £14.7 billion in 2024.
- Today’s coordinated action with Australia and the United States demonstrates the UK’s ongoing commitment to tackling malicious Russian cyber activity. Illicit Russian networks enabling cyber-attacks round the world are today exposed and sanctioned by the UK, in latest crack down on malicious Russian cybercrime.
Today’s action targets Media Land, one of the most significant operators of so-called “bulletproof” hosting services, which provides online infrastructure that enables cyber criminals to engage in illegal activity, including ransomware and phishing attacks.
These shadowy online networks allow cyber criminals and malicious actors to think they can act with impunity and destroy livelihoods – today’s action, taken alongside our allies in Australia and the United States and in collaboration with the UK’s National Crime Agency, proves otherwise.
Cyber criminals hiding behind Media Land’s services are responsible for ransomware attacks against the UK which pose a pernicious and indiscriminate threat with economic and societal cost, as well as malware and phishing campaigns.
Defending Europe from malicious Russian cyber and hybrid activity is a shared priority for the UK and Germany, with Foreign Secretary Yvette Cooper set to meet her German counterpart Johann Wadephul.
Foreign Secretary, Yvette Cooper, said:
Cyber criminals think that they can act in the shadows, targeting hard working British people and ruining livelihoods with impunity.
But they are mistaken – together with our allies, we are exposing their dark networks and going after those responsible.
Today’s measures will also directly target Media Land’s ringleader Alexander Volosovik, AKA Yalishanda, who has been active in the cyber underground since at least 2010, and is known to have worked with some of the most notorious cyber criminal groups, including Evil Corp, LockBit and Black Basta.
Ransomware attacks like those facilitated by Media Land significantly undermine the national security of the UK and our allies and directly harm British businesses. Cyber-attacks are estimated to have cost British businesses £14.7bn in 2024, accounting for 0.5% of GDP and growing every year.
The harm caused by ‘bulletproof’ hosting services like Media Land extends beyond enabling cyber-attacks against businesses, with their services providing cover for those carrying out a wide range of malicious activity. Aeza Group LLC, also sanctioned today, has provided ‘bulletproof’ services to support the work of the Social Design Agency – a Russian disinformation agency sanctioned by the UK in 2024 for its attempts to destabilise Ukraine and undermine democracies around the world. This action demonstrates our continued commitment to crack down on organisations that enable the Kremlin’s information war.
Alongside our allies, the UK is rooting out these criminal cyber gangs and going after their ringleaders – promoting growth by safeguarding British businesses, fundamental to this government’s Plan for Change.
Putin has turned Russia into a safe haven for these malicious cyber criminals, cultivating a dark criminal ecosystem with deep ties to the Kremlin. Through today’s action and repeatedly targeting malicious actors like LockBit and Evil Corp, the UK is disrupting these underground networks. If Russia isn’t going to clean up its act and go after these criminals, then the UK and our allies will.
Background
- Please see press releases on the UK’s sanctions against the Social Design Agency, ZSERVERS, LockBit and Evil Corp for more detail.
- Today, the National Cyber Security Centre and its international counterparts have issued new advice to help defend against potential malicious cyber activities enabled by bulletproof hosting providers, read more here.
- A full list of those added to the UK sanctions list today is as follows:
- MEDIA LAND LLC
- ML.CLOUD LLC
- Alexander Alexandrovich VOLOSOVIK
- Yulia Vladimirovna PANKOVA
- Kirill Andreevich ZATOLOKIN
- Andrei Valerevich KOZLOV
- AEZA GROUP LLC Media enquiries
Email newsdesk@fcdo.gov.uk
Telephone 020 7008 3100
Email the FCDO Newsdesk (monitored 24 hours a day) in the first instance, and we will respond as soon as possible.
Share this page
The following links open in a new tab
Updates to this page
Published 19 November 2025
Related changes
Get daily alerts for UK National Crime Agency
Daily digest delivered to your inbox.
Free. Unsubscribe anytime.
Source
About this page
Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission
Source document text, dates, docket IDs, and authority are extracted directly from NCA / FCDO.
The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.
Classification
Who this affects
Taxonomy
Browse Categories
Get alerts for this source
We'll email you when UK National Crime Agency publishes new changes.
Subscribed!
Optional. Filters your digest to exactly the updates that matter to you.