Loading threat actor…
Media Land, LLC is a Russian bulletproof hosting provider that has been publicly linked to enabling cybercriminal operations, including ransomware activity. Bulletproof hosting providers supply infrastructure designed to tolerate or shield abusive and illicit use, and Media Land has been associated with servicing a broad criminal customer base including ransomware operators, malware distributors, scammers, hackers, underground exchanges, and laundering services. Public reporting has tied its infrastructure to major cybercrime ecosystems and malware operations, including Dridex, Zeus, Egregor, Maze, Black Basta, Hunters International, Magecart, and the RIG Exploit Kit. The provider has been associated with Aleksandr Volosovik, also known as Yalishanda, who has been identified as advertising the service on underground forums. Media Land has also been linked to a broader network of related entities, including Media Land Technology LLC, Data Center Kirishi LLC, and ML.Cloud LLC, as well as successor or affiliated entities reportedly established after prior enforcement actions against similar infrastructure providers. Individuals linked to the network have also been connected to other sanctioned bulletproof hosting operations, including AEZA Group. Media Land is best characterized as cybercrime-enabling infrastructure rather than a conventional intrusion set or espionage actor. Its role is to provide resilient hosting and operational support that facilitates downstream criminal campaigns. High-confidence reporting supports its involvement in enabling ransomware operators and other financially motivated cybercriminals, but does not directly attribute to Media Land its own hands-on intrusion, malware deployment, or extortion operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Media Land, LLC is a Russian bulletproof hosting provider designated for enabling cybercriminal activities, including ransomware attacks. Its infrastructure supports a wide range of malicious operations, including hosting for underground exchanges, laundering services, scammers, hackers, and ransomware operators.
Media Land LLC. is a bulletproof hosting provider whose infrastructure is used by various cybercriminal groups to host malware, ransomware, carding shops, and exploit kits. In March 2025, internal data from Media Land was leaked, exposing client information and potentially aiding in attribution of malicious operations.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.