U.S. Sanctions Russian Service Provider Aeza Group

Recently, the U.S. Department of the Treasury's Office of Foreign Assets Control imposed sanctions on the Russian internet service provider Aeza Group and its related entities. The company is accused of providing hosting services for ransomware and information theft tools, thereby supporting cybercriminal activities.

The scope of this sanction includes Aeza Group itself, its UK front company, two Russian subsidiaries, and four senior executives. At the same time, a cryptocurrency wallet address associated with the company has also been added to the sanctions list.

Bradley T. Smith, Acting Deputy Secretary of the U.S. Treasury, stated that cybercriminals heavily rely on bulletproof hosting service providers like Aeza Group to carry out destructive attacks, steal technology, and conduct illegal drug transactions. He emphasized that the U.S. will work closely with international partners to continuously combat the key nodes and infrastructure that support this criminal ecosystem.

Aeza Group is a bulletproof hosting service provider headquartered in St. Petersburg. For a long time, the company has provided dedicated servers and anonymous hosting services to several well-known cybercrime groups, including information theft tool operators Lumma and Meduza, ransomware groups BianLian and RedLine, and the Russian darknet drug market Blacksprut. These organizations have repeatedly targeted the U.S. defense industry and global technology companies.

On-chain analysis shows that the sanctioned cryptocurrency wallet address has been active since 2023, receiving over $350,000 in USDT in total. This address has interacted with multiple well-known trading platforms and OTCs, suspected of being used for money laundering. In addition, it is also associated with other sanctioned entities, information theft service platforms, and dark web drug markets.

It is worth noting that despite the sanctions, Aeza Group is still actively responding. On the day the sanctions were announced, the company created new backup websites and shared these URLs with users through social media to ensure continuity of service.

This sanctions action marks a shift by global regulators in expanding the scope of their crackdown from direct attackers to providers of technological infrastructure that support criminal activities. For businesses, exchanges, and service providers, strengthening customer identification and transaction monitoring has become increasingly important to avoid engaging in business with high-risk entities, thereby mitigating potential sanctions risks.