The Russian service provider Aeza Group behind hackers, the dark web, and drug markets has been sanctioned.

Author: Lisa&Liz

Editor: Liz

Background

Recently, the U.S. Department of the Treasury's Office of Foreign Assets Control ( OFAC ) announced sanctions against the Russia-based Aeza Group and its affiliates, citing that the company provides hosting services for ransomware and information theft tools.

()

The sanctions cover Aeza Group and its UK front company Aeza International Ltd., two Russian subsidiaries (Aeza Logistic LLC and Cloud Solutions LLC), four executives (CEO Arsenii Penzev, Director Yurii Bozoyan, Technical Director Vladimir Gast, and Manager Igor Knyazev), as well as a cryptocurrency wallet (TU4tDFRvcKhAZ1jdihojmBWZqvJhQCnJ4F).

"Cybercriminals still heavily rely on bulletproof hosting providers like Aeza Group to launch destructive ransomware attacks, steal U.S. technology, and sell illicit drugs on the black market," said Bradley T. Smith, Acting Deputy Secretary of the Treasury for Terrorism and Financial Intelligence. "The Treasury will continue to work closely with the UK and other international partners to steadfastly uncover the key nodes, infrastructure, and individuals that support this criminal ecosystem."

This sanction action marks a shift in focus for international law enforcement agencies from the attackers themselves to the underlying technological infrastructure and service providers behind them. This article will outline the background and operational model of the Aeza Group, and analyze its role in the criminal ecosystem using the on-chain anti-money laundering and tracking tool MistTrack.

Who is Aeza Group?

()

Aeza Group is a bulletproof hosting service provider headquartered in Saint Petersburg, Russia, that has long provided dedicated servers and anonymous hosting services to cybercriminal groups such as ransomware gangs and operators of information stealing tools like infostealers, as well as to illegal drug trafficking platforms.

Its clients include notorious information theft tool operators such as Lumma and Meduza, which have attacked the U.S. defense industrial base and global tech companies; ransomware and data theft gangs BianLian and RedLine; as well as the well-known Russian dark web drug market Blacksprut. Aeza not only provides hosting services for Blacksprut but also participates in its technical architecture construction. According to OFAC disclosures, Blacksprut is widely used for the global distribution of fentanyl and other synthetic drugs, posing a serious threat to public safety.

( MistTrack Analysis

According to the on-chain anti-money laundering and tracking platform MistTrack analysis, the sanctioned address )TU4tDFRvcKhAZ1jdihojmBWZqvJhQCnJ4F( has been active since 2023 and has received more than 350,000 USDT in total.

![Russian service provider Aeza Group behind hackers, dark web, and drug markets sanctioned])https://img-cdn.gateio.im/webp-social/moments-59e5e160acf91db3b6dccce381259e82.webp###

According to MistTrack analysis, this address has interactions with the following objects:

• Transfer assets to multiple well-known trading platforms/OTC, such as Cryptomus, WhiteBIT, etc., for money laundering;
• Associated with sanctioned entities, such as Garantex, Lumma;
• Associated with the information theft service platform ( Stealer-as-a-Service ) promoted on Telegram;
• Associated addresses related to the darknet drug market Blacksprut.

According to the MistTrack counterparty function analysis, the interaction object ratio of this address is as follows:

In addition, we also found that on July 2, Aeza's Telegram was still active, and the administrator posted a backup link in case users could not smoothly log in to the main site:

Upon investigation, the creation dates of these two alternate websites coincide exactly with the day OFAC announced sanctions against Aeza.

( Conclusion

The sanctions against Aeza Group indicate that global regulators are expanding their focus from attackers to the technological service networks behind them. Hosting providers, anonymous communication tools, and payment channels are becoming new focal points for compliance enforcement. For businesses, exchanges, and service providers, KYC / KYT is no longer an "optional task"; if they inadvertently engage in business relationships with high-risk entities, they may face joint sanctions risk.