The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has imposed sanctions on Russia-based Aeza Group and its affiliated entities for providing hosting services to ransomware operators and information-stealing malware developers. This action reflects a strategic shift in global regulatory focus from targeting individual attackers to dismantling their technical support networks.

Sanctioned parties include Aeza Group, its UK front company Aeza International Ltd., two Russian subsidiaries (Aeza Logistic LLC and Cloud Solutions LLC), four executives (CEO Arsenii Penzev, Director Yurii Bozoyan, Technical Director Vladimir Gast, and Manager Igor Knyazev), and a cryptocurrency wallet (TU4tDFRvcKhAZ1jdihojmBWZqvJhQCnJ4F).

Bradley T. Smith, Acting Under Secretary for Terrorism and Financial Intelligence, stated that cybercriminals rely heavily on bulletproof hosting services like Aeza Group to conduct ransomware attacks, steal U.S. technology, and facilitate darknet drug markets. The Treasury Department will continue collaborating with international partners to expose key nodes in criminal ecosystems.

Analysis by blockchain tracking platform MistTrack reveals the sanctioned wallet has received over $350,000 in USDT since 2023, with transactions linked to:
– Cryptocurrency exchanges including Cryptomus and WhiteBIT
– Sanctioned entities Garantex and Lumma malware operators
– Stealer-as-a-Service platforms on Telegram
– Blacksprut darknet marketplace addresses

Aeza Group, headquartered in St. Petersburg, has provided infrastructure for:
– Infostealers Lumma and Meduza targeting defense and tech sectors
– Ransomware groups BianLian and RedLine
– Blacksprut’s fentanyl distribution network

Despite sanctions, Aeza’s Telegram channel remained active on July 2, announcing alternative domains created coinciding with OFAC’s announcement.

This enforcement action signals regulators’ expanding focus on service providers enabling cybercrime through hosting, anonymization tools, and payment channels. Compliance with KYC/KYT protocols is becoming essential to avoid secondary sanctions risks.

Note: MistTrack, developed by SlowMist, maintains over 300 million address labels and 900,000+ risk addresses for blockchain security and compliance monitoring.