Treasury Targets Aeza Group and Executive Board
The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has imposed sanctions on Russia-based Aeza Group, its senior executives, and a cryptocurrency wallet associated with facilitating ransomware and data theft operations.
Aeza’s Role in Bulletproof Hosting for Cybercriminals
OFAC described Aeza as a bulletproof hosting provider, offering specialized infrastructure to ransomware operators and info-stealer malware groups. The company’s servers have allegedly supported high-profile cybercriminal campaigns.
Sanctioned Wallet Linked to $350K in Crypto Assets
A crypto address on the Tron network associated with Aeza was sanctioned, containing approximately $350,000 in digital assets. This address functioned as an administrative wallet, handling payments from Aeza’s private payment processor and routing funds to various exchanges.
Wallet Activity Tied to Criminal Payment Networks
Blockchain analysis firm Chainalysis revealed that Aeza used intermediaries to obscure customer deposits. Meanwhile, TRM Labs confirmed consistent interactions between the wallet and other criminal payment services, including the sanctioned Russian exchange Garantex.
Hosting Services Used by Major Malware Operators
According to OFAC, Aeza hosted services linked to:
-
Meduza and Lumma (malware operations)
-
BianLian ransomware group
-
RedLine stealer panels
-
BlackSprut darknet marketplace
OFAC Targets Aeza’s Board Members
Sanctions were extended to members of Aeza’s leadership:
-
Arseniy Alexandrovich Bensyev (CEO & Co-owner)
-
Yuri Mirozhanovich Bozoyan (General Director)
-
Vladimir Vyacheslavovich Gast (CTO)
-
Igor Anatolyevich Knyazev (Current Manager & Shareholder)
Notably, Bensyev and Bozoyan were reportedly detained by Russian authorities over alleged ties to the darknet platform Blacksprut.
Sanctions Freeze All U.S.-Linked Assets
All U.S.-based assets belonging to Aeza or the designated individuals will be frozen. U.S. entities are prohibited from conducting any financial or commercial transactions with them, under penalty of civil and criminal enforcement.
Global Effort to Disrupt Cybercrime Infrastructure
Chainalysis commented that the sanctions mark a strategic shift toward targeting the infrastructure supporting cybercrime, not just the perpetrators. TRM Labs added that dismantling hosts like Aeza can significantly reduce exploitable avenues for malicious actors.
