The Australian Government and allies in the United Kingdom and the United States have today (20 November, 2025) jointly sanctioned two Russian men and two companies after international investigations into cybercriminal networks responsible for cyber attacks against Australian and international businesses.
The Australian Government has sanctioned two Russian men, Aleksandr Alexandrovich Volosovik (aka Yalishanda) and Kirill Andreevich Zatolokin, who operate two companies that provided services to cyber criminals on the dark web over a ten-year period.
The sanctioned companies - Media Land LLC and ML.Cloud LLC - provide a service known as 'bulletproof hosting', in which cyber criminals pay to use the companies' digital infrastructure to commit sophisticated cybercrimes such as ransomware attacks, malware infections, and scams.
These companies aid criminal activity by deliberately avoiding or ignoring requests from international law enforcement and governments to take down websites conducting illegal activity on their platforms.
Criminal campaigns that targeted Australia, the United States, the European Union, and the United Kingdom using Media Land LLC and ML.Cloud LLC infrastructure included:
Cyber attacks, such as denial-of-service, or distributed-denial-of-service attacks, against critical infrastructure, resulting in the disruption and degradation of services;
Malware campaigns targeting Australians and Australian financial institutions;
Ransomware attacks by syndicates including Lockbit, Blacksuit, and Clop against Australian and international businesses, resulting in the exfiltration of data, encryption of systems, and extortion of victims.
Today's sanctions imposed by the Minister for Foreign Affairs on Volosovik, Zatolokin, Media Land LLC and ML.Cloud LLC include financial penalties and travel bans to disrupt criminal activity, expose cybercriminals' identities, and impose costs and consequences on cybercriminals.
This is the fifth use of Australia's cyber sanctions framework against malicious cyber actors and the second time against entities.
These sanctions are supported by the intelligence and investigative capabilities of the Australian Signals Directorate and the AFP under joint standing Operation Aquila and are part of ongoing coordinated international law enforcement action.
Under the cyber sanctions framework, it is a criminal offence for Australians or people in Australia to provide assets to the sanctioned individuals or to deal with Media Land LLC or ML.Cloud LLC.
It is also an offence to use or deal with their assets, including through cryptocurrency wallets or ransomware payments. Any assets owned by the two cybercriminal services or the two men must be frozen.
The maximum penalty for anyone breaching sanctions is 10 years' imprisonment and/or significant fines.
AFP Cyber Command Assistant Commissioner Richard Chin said the darknet services and the two Russian men helped international cybercriminals attack Australians and stole from innocent victims.
"They provided cybercriminals with a perceived layer of protection, by refusing to take down websites with illegal content that had been flagged by international law enforcement agencies and governments," Assistant Commissioner Chin said.
"The name suggests they are 'bulletproof', but our message to cybercriminals is clear - just because you operate on the dark web, it does not mean you are beyond law enforcement and our partners. We can see your criminal activity and we will find you."
Australia's Ambassador for Cyber Affairs and Critical Technology, Ms Jess Hunter, said
"The Australian Government was determined to hold malicious cyber actors to account.
"Cyber sanctions work to deter cybercrime and help protect Australians by exposing the activities and identity of malicious cybercriminals operating across jurisdictions, placing them at further risk of detection wherever they may hide."
Risk Warning: Cryptocurrency is a unregulated virtual notoriously volatile instrument with a high level of risk. Any news, opinions, research, data, or other information contained within this website is provided for news reporting purposes as general market commentary and does not constitute investment or trading advice.
