{"id":13634,"date":"2025-07-02T05:42:46","date_gmt":"2025-07-02T03:42:46","guid":{"rendered":"https:\/\/wsj-crypto.com\/?p=13634"},"modified":"2025-07-02T05:42:46","modified_gmt":"2025-07-02T03:42:46","slug":"us-imposes-sanctions-on-ransomware-and-infostealer-hosting-providers","status":"publish","type":"post","link":"https:\/\/wsj-crypto.com\/index.php\/2025\/07\/02\/us-imposes-sanctions-on-ransomware-and-infostealer-hosting-providers\/","title":{"rendered":"US Imposes Sanctions on Ransomware and Infostealer Hosting Providers"},"content":{"rendered":"

“`html
\n<\/p>\n

\n

The US Treasury has penalized the Russia-based Aeza Group, along with its leadership and a crypto wallet associated with the organization, for purportedly facilitating ransomware and information stealers.<\/p>\n

Aeza Group, a bulletproof hosting (BPH) services provider, allegedly markets access to tailored servers and additional computer infrastructure to assist cyber offenders in executing ransomware operations and acquiring sensitive data<\/a>, the Treasury\u2019s Office of Foreign Assets Control (OFAC) announced<\/a> on Tuesday.<\/p>\n

OFAC\u2019s penalties also encompass an address holding $350,000 in cryptocurrency<\/a>, several companies based in Russia and the UK, and four Russian individuals who are reportedly co-owners or executives at Aeza.<\/p>\n

Crypto users are repeatedly targeted with ransomware and other data stealers, with blockchain security entity CertiK attributing the majority<\/a> of the $2.1 billion in stolen cryptocurrency for 2025 thus far to phishing attempts that compromise sensitive information such as crypto wallet keys.<\/p>\n

Source: <\/em>Chainalysis<\/em><\/a><\/figcaption><\/figure>\n

Aeza crypto address was an administrative wallet<\/h2>\n

OFAC sanctioned a Tron blockchain address recognized as an administrative wallet, managing cash-outs from Aeza\u2019s payment processor, routing funds to various crypto exchanges and intermittently receiving direct payments for Aeza\u2019s services, blockchain analytics enterprise Chainalysis stated<\/a> on Tuesday.<\/p>\n

\u201cOn-chain investigations and further research suggest that Aeza depended on a payment processor to receive funds for hosting services, thereby obscuring the traceability of customer deposits,\u201d the firm added.<\/p>\n

The sanctioned Tron crypto address served as an administrative wallet that managed payments for Aeza, according to Chainalysis. Source: <\/em>Chainalysis<\/em><\/a><\/figcaption><\/figure>\n

Blockchain intelligence agency TRM Labs noted<\/a> on Tuesday that the crypto address also maintained regular cash-out connections to payment service providers and is linked via intermediary addresses to other cybercriminal services and the sanctioned Russian crypto exchange Garantex<\/a>.<\/p>\n

OFAC alleged that Aeza Group, located in St. Petersburg, supplied BPH services to ransomware and malware organizations including the Meduza and Lumma infostealer operators<\/a>, BianLian ransomware, RedLine infostealer panels, and BlackSprut, a Russian darknet marketplace.<\/p>\n

Aeza\u2019s board of directors sanctioned<\/h2>\n

OFAC further sanctioned individuals it identified as members of Aeza\u2019s \u201cboard of directors,\u201d which includes CEO and part owner Arsenii Aleksandrovich Penzev, general director and part owner Yurii Meruzhanovich Bozoyan, technical director Vladimir Vyacheslavovich Gast, and Igor Anatolyevich Knyazev, another part owner.<\/p>\n

It asserted that Knyazev is overseeing the operations following the arrests of Penzev and Bozoyan by Russian authorities concerning their alleged ties to the illicit dark marketplace Blacksprut.<\/p>\n