The US Department of Justice just put a $10 million bounty on the heads of three Russian nationals accused of running the digital equivalent of a fortified safe house for some of the world’s most prolific ransomware gangs. The charges, unsealed on July 14, allege the trio operated “bulletproof hosting” services that shielded cybercriminals from law enforcement while they extracted tens of millions of dollars from American institutions.

What bulletproof hosting actually means

The two companies named in the indictment, Media Land LLC and ML.Cloud LLC, allegedly provided server infrastructure specifically designed to resist takedown requests from law enforcement and abuse complaints from victims.

The federal indictment links these services to some of ransomware’s biggest names, including LockBit and BlackSuit. These groups have collectively been responsible for billions in damages globally, locking up the computer systems of banks, hospitals, schools, and media outlets, then demanding cryptocurrency payments to restore access.

Victims across 21 US states reported tens of millions of dollars in losses tied to attacks facilitated through these hosting services. The charges include computer fraud, wire fraud, and money laundering.

The $10 million reward is being offered through the State Department’s Rewards for Justice program.

The crypto connection runs deep

The timing is worth noting. Sanctions against Media Land and its affiliates first landed in November 2025. Then on July 13, just one day before the indictment was unsealed, the US Treasury sanctioned First VPN Service and an individual named Yegeniy Silayev for related activities. This wasn’t a single strike. It was a coordinated campaign that unfolded over months.

What this means for crypto investors and the broader market

The pattern of sanctions in November 2025, followed by additional sanctions on July 13, followed by a federal indictment on July 14, suggests a methodical, multi-agency approach rather than a one-off action.