Ransomware gangs need servers that stay online when the police come knocking. For years, US prosecutors say, three people in St. Petersburg sold exactly that. The attacks that ran through their machines hit American banks, schools, hospitals, and government offices, and they cost victims more than $62 million.
Prosecutors made the charges public Tuesday in a federal court in Ohio. The indictment names Alexander Volosovik, Kirill Zatolokin, and Yulia Pankova, plus the two St. Petersburg companies behind the service, Medialand and ML.Cloud. The charges cover computer fraud, wire fraud, and money laundering.
Servers built to ignore the police
A normal hosting company kicks out a customer who spreads malware. Prosecutors say Medialand and ML.Cloud did the opposite. Volosovik allegedly pitched the service on crime forums, promising servers that basically ignore abuse reports and takedown demands. Criminals call this bulletproof hosting, and it's one of the quiet businesses that keep the rest of cybercrime running.
Court papers say clients used the servers to spread malware and ransomware, then squeeze the infected victims for cash and crypto. Others ran phishing sites and criminal marketplaces from the same machines, and some used them for password-guessing attacks. Prosecutors count 42 victims across 21 US states. Physically, the machines sat in Russia, China, Finland, the Netherlands, and the United States.
Justice Department indictment announcement
No handcuffs anytime soon
Nobody got arrested this week. Honestly, nobody may ever be. All three live in Russia, and Russia doesn't hand its citizens over to US courts, so unless one of them travels to a country that will hand them to the FBI, this case will probably never reach a jury.
So the US is squeezing instead. The Treasury Department sanctioned all three people and both companies back in November 2025, which cuts them off from US banks. Britain joined those sanctions in full and Australia in part. And the State Department is now offering up to $10 million, plus possible relocation, for tips that link the network or its owners to a foreign government.
That reward tells you where investigators think this goes. They aren't just after three server landlords, they want evidence that a government was using the same racks. All the defendants are presumed innocent unless a court decides otherwise. But naming them and freezing them out of western banks is the one real lever the US has here, and it's pulling that lever hard.
