Loading threat actor…
Aeza Group is a Russia-based bulletproof hosting provider associated with cybercrime and sanctioned by the United States and allied governments for enabling malicious online activity. Operating from St. Petersburg, Aeza Group has provided abuse-resistant infrastructure used to support malware delivery, command-and-control operations, ransomware activity, dark web criminal services, and pro-Russian influence operations. A UK-based entity, Hypercore, has been identified as a front company used to help Aeza rebrand and shift infrastructure after sanctions pressure. Aeza has also been linked to the Kremlin-connected Social Design Agency. Aeza Group functions primarily as an enabling service provider rather than a conventional intrusion set. Its infrastructure has been tied to stealer malware and ransomware ecosystems, including support for operations involving BianLian, RedLine, Meduza, and Lumma. Reporting has linked Aeza-hosted infrastructure to a macOS infostealer campaign delivered through ClickFix social-engineering lures, where hosted components included loader delivery, payload hosting, and command-and-control. Across these uses, Aeza-supported operations have facilitated credential theft, cryptocurrency theft, malware staging, and post-compromise communications. As a bulletproof host, Aeza Group is notable for providing resilient infrastructure intended to withstand abuse complaints, law-enforcement scrutiny, and takedown efforts. Sanctions reporting indicates the group supported global attacks affecting U.S. technology and defense organizations and enabled infrastructure used by cybercriminals for malware campaigns and ransomware operations. Aeza is best understood as part of the broader Russian cybercrime-enablement ecosystem that supplies hosting and operational support to financially motivated threat actors.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Associated with the malware infrastructure in this campaign, including loader delivery, payload hosting, and C2; described as a sanctioned Russian bulletproof hoster associated with cybercrime.
Aeza Group is a Russia-linked bulletproof hosting provider that has supported cybercrime operations and attempted to evade sanctions by rebranding and moving infrastructure to UK-based entities.
Aeza Group is a bulletproof hosting provider previously sanctioned for supporting cybercrime, with Hypercore acting as a front company.
Aeza Group is a bulletproof hosting company previously sanctioned for supporting cybercriminal operations and is linked to Kremlin disinformation activities via the Social Design Agency.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.