Executive Summary and Provider Overview

Quick-Reference Attributes

Overall Assessment

Aeza Group is a St. Petersburg-based bulletproof hosting (BPH) provider that presented publicly as a low-cost, high-performance VPS/VDS and dedicated-server business while functioning as core infrastructure for ransomware, infostealer, darknet-market, and Russian state-aligned disinformation operations. OFAC, which designated the group on 1 July 2025, described Aeza as a BPH service that "allows cybercriminals to avoid law enforcement while renting IP addresses, servers and domains" and specifically named the Meduza and Lumma infostealer operators, BianLian ransomware, RedLine infostealer panels, and the BlackSprut darknet drug marketplace as hosted activity. [1]

The provider is the assessed successor to MskHost, a predecessor BPH brand founded circa 2019 by Yurii Bozoyan and taken offline by hacktivists in September 2021. Aeza Group LLC was incorporated in June 2021 with Bozoyan, Arsenii Penzev, and Igor Knyazev each holding 33%. Its business model deliberately routed criminal clients through a downstream reseller chain (LetHost, ZeroHost, and others), which advertised the "bulletproof" property to end users while Aeza maintained plausible deniability at the core ASN level. [1][14][15]

Aeza was assessed as Degraded in the July 2026 profile; as of October 2026 it is assessed Active and larger than before sanctions (see the paragraph that follows). Russian authorities arrested Penzev, Bozoyan, and Gast in February/April 2025 (charged with narcotics and organized-crime offenses tied to BlackSprut, not cybercrime), and OFAC/UK/Australia sanctions followed. Within nineteen days of the July 2025 OFAC action, Silent Push detected roughly 2,100 IP addresses migrating from AS210644 to the newly registered AS211522 (Hypercore Ltd), and the November 2025 tri-lateral action designated Hypercore plus Serbian and Uzbek successor shells and two additional operators (Makarov, Zakirov). The European Union imposed no sanctions, and Recorded Future described Aeza as "one of the most significant sources of malicious infrastructure" as recently as November 2025. The single largest structural leverage point remains the group's dependency on German upstream aurologic GmbH for its European footprint. [2][10][11][14]

Confirmed October 2026 reassessment. The Hypercore route proved temporary: Hypercore Ltd was recorded as dissolved on 23 December 2025, AS211522 stopped announcing on 7 February 2026 and its RIPE registration has since been deleted. The address space did not disappear. From 6 February 2026 former Hypercore prefixes (for example 83.147.192.0/24) appear under NetCrafters OÜ (AS203273, Estonia), and the two original Aeza ASNs grew: on 29 October 2026 AS210644 announces 316 IPv4 prefixes and AS216246 58, together about 109,000 addresses, with NetCrafters adding 171 prefixes. Qurium's September 2026 count is 536 /24 networks and about 137,000 addresses, roughly twenty times the end-2022 baseline. In the RIPE database the maintainer lir-ru-aezagroup-1-MNT now controls 245 objects, 57 of them IPv4 blocks registered after the 1 July 2025 OFAC action, the latest on 13 October 2026, and AEZA GROUP LLC itself holds a RIPE NCC LIR organisation record created 29 December 2025. aurologic remains the dominant upstream. Two rounds of US, UK and Australian sanctions have therefore not reduced Aeza's ability to obtain or route IP space; what they changed is the corporate wrapper. [25][26][27]

Silent Push // IOFA Migration Detection

Silent Push IOFA (Indicators of Future Attack) feed detecting the automated reclassification of Aeza infrastructure from AS210644 to the newly registered AS211522 (Hypercore Ltd) on 20 July 2025, nineteen days after the OFAC designation.

Silent Push, July 2025

Silent Push // Shared Prefix Evidence

BGP data (via bgp.tools) showing the 83.147.192.0/24 subnet announced by both AS210644 (Aeza) and AS211522 (Hypercore), supporting the attribution of the successor ASN. Example migrated host: 83.147.192[.]5.

Silent Push / bgp.tools, July 2025

Silent Push // AS211522 Allocation Data

Silent Push Total View data confirming AS211522 was allocated on 10 July 2025 and already contained over 2,100 IP addresses, an unusually rapid ramp-up for a newly allocated autonomous system.

Silent Push, July 2025

TRM Labs // On-Chain Wallet Graph

TRM Labs on-chain analysis graph published alongside the November 2025 coordinated sanctions, illustrating fund flows across the Russian BPH ecosystem and intermediary wallets tied to bulletproof hosting operators.

TRM Labs, November 2025

U.S. Treasury // OFAC Designation

U.S. Department of the Treasury. OFAC press release SB0185 (1 July 2025) designated Aeza Group, Aeza International Ltd, Aeza Logistic LLC, Cloud Solutions LLC, and four Aeza leaders for enabling ransomware, infostealer, and darknet-market operations.

U.S. Treasury / OFAC, July 2025

Lineage and Organizational Heritage

Predecessor and Sibling Analysis

Aeza is assessed as the direct successor to MskHost (MSK.host), a bulletproof and abuse-tolerant hosting provider founded circa 2019 by Yurii Bozoyan and known for launching DDoS attacks against competing hosts. MskHost was taken offline by hacktivists "who had enough" in September 2021, per researcher compilation at aeza-gang.com and corroborating forum records. The same operator pool, principally Bozoyan and Penzev, incorporated Aeza Group LLC on 17 June 2021 and marketed a public launch date of 26 December 2021. [15]

Brand, Entity, and Sibling Structure

Additional UK entities identified by researchers as part of the network include AEZA GROUP LIMITED (Co. 15065828), AEZATRADE LIMITED (Co. 15172068), and QWINS LTD (Co. 16072422). Researcher-identified sibling ASNs include AS210352 (Partner LLC), AS211409 (Shelter LLC), AS209224 (CYBERHUB-AS), and AS216319 (CHROMIS IT LTD). [15]

Operator Profiles

Six individuals have been sanctioned across the July and November 2025 actions; three were arrested by Russian law enforcement in early 2025. All are Russian nationals. The escalated operator module appears above the fold in Section 01. Detailed profiles follow.

2.1 Yurii Meruzhanovich Bozoyan

2.2 Arsenii Aleksandrovich Penzev

2.3 Vladimir Vyacheslavovich Gast

2.4 Igor Anatolyevich Knyazev

2.5 Maksim Vladimirovich Makarov

2.6 Ilya Vladislavovich Zakirov

Non-Designated Front Persons

Marat Timurov (Uralsk, M. Ihsanov str. 45, Kazakhstan) is identified by researchers as the nominal front person for Aeza International Ltd (UK Co. 15109642); not OFAC-designated as of the record date. Separately, open reporting attributes the registration of Hypercore Ltd to a "Patryk Drozda" two days after the July 2025 sanctions. [SINGLE SOURCE] This registrant name should be treated as CREDIBLE pending Companies House corroboration; it does not appear in the OFAC designation text. [15]

Disputed Assessments

Penzev publicly disputed the Doppelgänger and state-nexus allegations (see Section 03 verbatim copy), and Aeza's official agent characterized reseller connections (LetHost/ZeroHost) as mere IP-transit relationships terminated after complaints. These claims are contradicted by (a) OFAC's finding that Bozoyan and Penzev "began to provide Blacksprut with services in 2023," and (b) forum evidence of identical server hardware appearing simultaneously at Aeza and the resellers. The name "Yuri" vs. "Yurii" for Bozoyan varies between OFAC (Yurii) and secondary reporting; treated as the same individual. [1][14][15]

Operational and Business Model

Service Model

Aeza publicly marketed itself as a high-performance, affordable VPS/VDS and dedicated-server provider for legitimate customers, developers, and VPN users. Advertised products included KVM VPS on AMD Ryzen 9 7950X3D/9950X with NVMe storage from roughly €4.94/month, dedicated Threadripper and i9-class servers from about €200/month, anti-DDoS on all plans, and locations spanning Moscow, St. Petersburg, Stockholm, Helsinki, Amsterdam, Vienna, Paris, Frankfurt/Falkenstein, London, Hong Kong, and Los Angeles. Behind this commercial face, OFAC assessed Aeza as a de facto BPH provider that "allows cybercriminals to avoid law enforcement while renting IP addresses, servers and domains used for disseminating malware, supporting darknet markets and carrying out other tasks related to fraud and cyberattacks." [1]

Plausible deniability was maintained by routing malicious clients through a downstream reseller chain rather than direct onboarding (see reseller chain below). This architecture is the primary mechanism by which Aeza insulated its core ASNs from direct attribution. [1][14]

Verbatim Advertising Copy

Pricing (Documented Examples)

Onboarding

Aeza operated an open-signup model with no identity verification. A third-party review site documented that "the service supports anonymous registration, no real-name verification, and accepts cryptocurrency payments." Penzev framed equal treatment of all clients (including censorship-evading and opposition-linked projects) as a neutral, apolitical posture; no vetting of client intent was performed. [14]

Downstream Reseller Chain

• LetHost / ZeroHost ran "on your hardware" per direct LowEndTalk accusations. A forum participant reported contacting St. Petersburg law enforcement about the Aeza connection in 2022 and being told "in Russia it is not forbidden to keep such hosting." The FBI reportedly later shut down LetHost. Aeza's agent claimed these were merely IP-transit clients cut off after complaints, disputed by evidence of identical hardware at both operations. [14][19]
• TNSecurity Ltd (UK): researcher-identified downstream distributor running "prefix swapping with AEZA."
• Shelter LLC (AS211409): hosted C2 for Lumma, Meduza, and Mystic stealers.
• Doppelgänger's European infrastructure was accessed through this chain, with Aeza upstream while UK shells (TNSecurity, Liber Systems) appeared as direct operators. [12][13]

Russian IT-law specialists consulted by investigace.cz noted that "legal liability may extend to the original hosting providers, not just the resellers." [14]

Abuse Handling and LE Posture

Stated posture: "We always respond to all complaints" (Aeza agent, July 2024); Penzev: "If we receive a complaint from Roskomnadzor, we forward it to the client." Documented behavior contradicts this: Aeza hosted BlackSprut for roughly two years before Russian action; Spamhaus flagged LetHost/ZeroHost-linked subnets; and OFAC found Bozoyan and Penzev "began to provide Blacksprut with services in 2023." Penzev's claim that Aeza terminated the BlackSprut reseller "because of the large number of reports we received from Spamhaus" is directly contradicted by the OFAC finding. Support ran via a 24/7 Telegram bot (@aezasupport_bot), a ticket panel, and RIPE abuse contacts abuse@aeza.net / abuse@aeza.ru. [1][14]

OPSEC

Multi-jurisdiction incorporation (RU LLC, UK Ltd, plus post-sanctions Serbia and Uzbekistan shells), reseller abstraction, anonymous crypto/e-wallet payments, and separation between Russian-controlled hardware and European delivery infrastructure. The principal OPSEC failure was operator concentration in Russia: all six designated operators are Russian nationals, and three founders were arrested domestically. [1][2][14]

Technical Capabilities and Infrastructure Footprint

Autonomous Systems

RIPE abuse contact (AS210644): abuse@aeza.net. Registration verification (29 Oct 2026): AS210644 and AS216246 confirmed live in the RIPE database; AS211522 returns no object. The AS210644 to AS211522 migration of July 2025 is corroborated across Silent Push, bgp.tools, IPinfo, and RIPEstat. The registered organisation for AS210644 is now AEZA GROUP LLC (St. Petersburg), not the Sheffield front. [10][16][24][27]

Full RIPE Footprint (Maintainer Analysis)

Confirmed Inverse lookup on the operator maintainer lir-ru-aezagroup-1-MNT on 29 October 2026 returns 245 objects: 2 ASNs (AS210644, AS216246), 42 legacy ranges, 147 ASSIGNED PA, 29 SUB-ALLOCATED PA, 20 IPv6 assignments, and one IPv6 allocation direct from RIPE NCC (2a01:e5c0::/29, ALLOCATED-BY-RIR to ORG-AGL50-RIPE, object dated 6 March 2026). The maintainer is in RIPE NCC's standard LIR format, which indicates a direct RIPE NCC membership held by AEZA GROUP LLC. 57 IPv4 blocks were created after the 1 July 2025 OFAC designation, in six clusters: [27]

Confirmed The LIR organisation record lists 21 referencing maintainers (mnt-ref), including INTERLAN, NETERRA, QWARTA, WEBROCKET, IROST, Renets, LocalNCC, ROSNIIROS and sistemallc: the set of LIRs and brokers entitled to assign space to Aeza. This matches Qurium's finding that eleven LIRs supply about two-thirds of Aeza's addresses (Plant Holding GmbH, Axiom Asia Services, Prostie Reshenia/WebRocket, RapidSeedbox, Technology Enriched Company FZCO, Oner Investments, Andwase Limited, FREEnet, IROST, Digital Network/IPPort, Pronet). Analyst Inference Blocks registered in clusters days apart, with netnames pre-assigned to European cities, indicate planned capacity build-out rather than organic growth; the unannounced 195.88.92.0/23 registered 9 October 2026 is staged capacity. [25][27]

Threat Intelligence Standing of the 57 Post-Sanctions Blocks

Confirmed Checked 29 October 2026 by direct API query of every address in the 57 blocks (14,734 addresses) against ThreatFox and URLhaus, and by AbuseIPDB check-block per /24 (30-day window). 29 of 57 blocks carry at least one post-registration signal; 28 carry none. [28]

Analyst Inference Time-to-abuse is short: C2 and malware-distribution entries appear within days of registration (URLhaus four days after the December 2025 AEZA-SE blocks; Mirai nine days after the 2 October 2026 Moscow block). The 28 blocks with no signal include the five newest registrations and the unannounced 195.88.92.0/23, consistent with staged capacity not yet populated. The malware mix (PureRAT, Vidar, Sliver, Cobalt Strike, AsyncRAT, Quasar, AdaptixC2, BianLian, Mirai) is the same C2-and-stealer profile OFAC cited in 2025, now running on address space acquired after the designation. [28]

IP Ranges and Geographic Footprint

• AS210644 (Aeza International): primary footprint in Sweden, with additional presence in the Netherlands and Germany, plus smaller footprints in 10+ countries (Finland, Austria, France, UK). [10][11]
• AS216246 (Aeza Group): Russia-registered; ~26 IPv4 prefixes, ~6,656 addresses (late 2025); 58 prefixes, 14,848 addresses on 29 October 2026. [27]
• Ecosystem total (pre-migration): ~100,000+ IPs; Qurium estimated Doppelgänger-associated infrastructure at 300+ prefixes and 100,000 IPs. [12]
• Ecosystem total (September 2026, Qurium): 536 IPv4 /24 networks, about 137,216 addresses (AS210644 and AS216246: 418 prefixes, 107,008 addresses; NetCrafters AS203273: 118 prefixes, 30,208 addresses), against 25 prefixes and about 6,400 addresses at end-2022. [25]
• Migrated example host: 83.147.192[.]5 (subnet 83.147.192.0/24 announced by both AS210644 and AS211522 in July 2025; announced by NetCrafters AS203273 on 29 October 2026). [10][27]

Physical data centers: Europe (primary) - aurologic GmbH facility, Robert-Bosch-Str. 25, 63225 Langen, Germany; Russia - Moscow and St. Petersburg nodes (directly controlled). European servers are primarily sourced through Hetzner resale and aurologic colocation. [11][15]

Upstream Transit Provider Chain

Resilience Techniques

• Rapid ASN registration: AS211522 (Hypercore) allocated 10 Jul 2025, nine days after sanctions, with 2,100+ IPs within ten days. [10]
• Front-company rotation to hold IP space and RIPE registration independent of the Russian parent; reversed in 2026, when AS210644 was re-registered to the Russian parent's own RIPE NCC LIR record (created 29 December 2025) after the UK fronts were designated and dissolved. [27]
• Leased address space from a wide set of LIRs and IP brokers (21 referencing maintainers on the RIPE org record; Qurium names eleven suppliers holding two-thirds of the space), so no single supplier is a chokepoint. [25][27]
• Reseller abstraction insulating core ASNs from direct attribution.
• Multi-jurisdiction incorporation (RU, UK, Serbia, Uzbekistan).
• Anti-DDoS on all plans; Gast linked to botnet-based DDoS capability.
• Anonymous payment methods (crypto, QIWI, PerfectMoney, YouMoney) reducing KYC trails.

Hosted Activity Types

Blocklist Standing

Delisting history: No documented delisting attempts or successful delistings. Aeza's stated position was that complaints were forwarded to clients; no documented engagement with Spamhaus delisting procedures for the ASN-DROP entry. [16]

Known Weaknesses and Single Points of Failure

• aurologic dependency: the entire European delivery path transits aurologic GmbH; coordinated pressure would sever the European footprint. aurologic resisted through November 2025 citing "infrastructure neutrality." [11]
• UK corporate registration: successive UK shells (Aeza International, Hypercore, AEZATRADE, QWINS) are Companies House entities subject to UK OFSI designation, which acted rapidly in November 2025.
• Russian operator vulnerability: all confirmed operators are Russia-based nationals; three founders are in pre-trial detention.
• TRON wallet exposure: the designated TRON address was publicly identified; successor payment channels (Zakirov-established) are not yet publicly traced.
• IP-space visibility: ASN-DROP makes AS210644 ranges trivially blockable at BGP by any network implementing Spamhaus DROP feeds. [16][23]

Financial Infrastructure

Payment Methods

Advertised methods included Bitcoin, USDT (TRC20/BEP20/ERC20/TON), Litecoin, Dogecoin, BTC Cash, ETH, SOL, BNB, TRX, TON, USDC; bank cards ("of any country"); PayPal (via support); and the Russian e-wallets QIWI, YouMoney (formerly Yandex.Money), and PerfectMoney. WebMoney and SteamPay were observed in third-party reviews. Forum users noted that Russian-only payment methods carried low fees while international methods carried ~10% fees, interpreted as evidence that operations were financially centered in Russia. [18][14]

Designated Cryptocurrency Address

Three-Phase Laundering Model

Source: Chainalysis and TRM Labs analyses of the designated TRON address (1 July 2025). [7][8]

Phase 1 - Acquisition: Aeza used an intermediary payment processor to receive hosting fees, obscuring direct traceability. The designated TRON address functioned as an administrative/cash-out wallet rather than the primary customer-facing deposit address, so total inflow is likely larger than the $350,000 visible. Direct payments from infostealer vendors matched Aeza service pricing; regular payment pathways ran through Garantex (per TRM Labs).

Phase 2 - Layering: Funds routed through intermediary addresses before cash-out. Garantex (OFAC-sanctioned March 2025, disrupted by US/Germany/Finland) served as a layering node. Chainalysis also noted connections to "an escrow service used for selling items on a popular gaming platform," an unusual pattern that may represent deliberate obfuscation using legitimate-seeming transaction flows.

Phase 3 - Extraction: Regular cash-out points to global cryptocurrency exchanges and payment-service providers. Chainalysis Reactor graphs showed deposit addresses receiving funds from multiple sources including Garantex and an infostealer vendor. No OTC broker relationships were specifically documented in available public sources.

Post-sanctions payment infrastructure: per OFAC (19 Nov 2025), Ilya Zakirov "helped establish new companies and payment methods to obfuscate Aeza's continuing activity." Specific successor addresses are not yet publicly documented. [2]

Sanctions and Risk Designations

• Garantex: OFAC-sanctioned April 2022; disrupted March 2025; operators indicted (E.D. Va.). Aeza flows confirmed to transit Garantex. [8]
• TRON address: on the OFAC SDN List since 1 July 2025.
• No VASP-level designation specifically for Aeza's payment processor has been identified.

Client Profile and Hosted Operations

Crimeware Verticals by Evidence Tier

Client Geography and Target Profile

Aeza's infrastructure was physically distributed across Western Europe (Germany, Sweden, Netherlands, Finland, Austria) while operator leadership was exclusively Russian (St. Petersburg), creating a deliberate jurisdictional split: European server locations gave reduced latency for European/US-targeted campaigns while operator liability remained in Russia, where enforcement was absent until 2025. No confirmed CIS exclusion policy is documented, though Aeza's marketing emphasized service to Russian users evading censorship. [1][14]

Notable Hosted Cases

Case 1 - BlackSprut Darknet Drug Market (2023-2025)

Primary infrastructure host and anti-DDoS backbone. BlackSprut was described as one of the world's largest darknet marketplaces; Jan-Sep 2025 transaction volume was estimated at $1.85 billion. OFAC: "Aeza Group has also hosted … BlackSprut, a Russian darknet marketplace for illicit drugs." Gast "oversaw the technical details of placing Blacksprut on Aeza Group infrastructure." Bozoyan and Penzev were arrested Feb/Apr 2025 and charged under Articles 210 and 228.1 (up to 20 years). [1]

Case 2 - Meduza and Lumma Infostealers (2023-2025)

C2 hosting and IP provisioning via Aeza International (UK). OFAC: these operators "used the hosting service to target the U.S. defense industrial base and technology companies." Lumma infected ~10 million systems before its May 2025 takedown. IOC: 147.45.78[.]8:80 (Meduza C2, AS210644). OFAC: "Aeza International serves as a front company to lease IP addresses to cybercriminals, including Meduza infostealer operators." [1]

Case 3 - Doppelgänger Disinformation (2022-2025)

Core European infrastructure hub hosting fake sites impersonating Der Spiegel, The Guardian, Le Monde and others across 10+ countries. The Record (July 2024): "At the core of Doppelgänger's operation in Europe and Russia is a company called Aeza." UK FCDO designated Aeza for "provision of 'bulletproof hosting services' to the Social Design Agency (SDA)." Qurium scale: 300+ prefixes, 100,000+ IPs, ~€5M market value, ~€50,000/month leasing cost - "can only be sustained by serious financial support from external actors." [5][12][13]

Case 4 - BianLian Ransomware

Infrastructure host for the double-extortion group. Confirmed by OFAC and CyberScoop; no specific IPs or timeframes documented in open sources. [1][22]

State Nexus Assessment

Positive Evidence

• Direct SDA client relationship (strongest indicator): UK FCDO confirmed Aeza "provided 'bulletproof hosting services' to the Social Design Agency (SDA)," an entity "tasked and funded directly by the Russian State" implementing campaigns "at the direction of the Russian Presidential Administration." [5]
• Doppelgänger financing scale: 300+ prefixes, 100,000+ IPs, ~€50,000/month "can only be sustained by serious financial support from external actors" (Qurium/EU DisinfoLab). [12]
• Wagner Center co-location: Aeza's St. Petersburg office was in a building that served as the Wagner Center until 2023. No direct evidentiary link between Aeza and Wagner structures has emerged; geographic co-location is noted only.
• Selective non-enforcement: Aeza operated with apparent impunity in Russia for ~4 years (2021-2025) despite public BPH documentation; Russian action came only via narcotics law (BlackSprut), not cybercrime or malicious-infrastructure hosting.
• Timing: analysts have questioned whether the arrests represent genuine law enforcement or internal reorganization of the security apparatus (aeza-gang.com). [15]

Negative Evidence and Limitations

• No confirmed direct state control: no evidence that operators are FSB/GRU/SVR personnel or that the entity is state-operated. It presents as a commercially motivated criminal enterprise that accepted state-adjacent clients (SDA) among a broader portfolio.
• Genuine RU criminal jeopardy: the arrests of Bozoyan and Penzev are inconsistent with an entity under active state protection, though the charges relate to narcotics, not the cyber/disinformation activity of primary interest.
• Penzev's public "apolitical" claims: more consistent with plausible-deniability commercialism than a witting state asset (not conclusive).
• EU non-action: the absence of any EU sanctions despite servers in Germany, Sweden, and the Netherlands is notable; drivers are not determinable from available evidence.

Law Enforcement and Regulatory Response

Arrests, Sanctions, and Seizures

Three founders (Bozoyan, Penzev, Gast) were arrested and remain in Russian pre-trial detention on narcotics/organized-crime charges. Sanctions span three authorities (US, UK, Australia) across two rounds. No infrastructure seizure by any EU member state has been documented; European capacity at aurologic, Hetzner and leased LIR space was still growing in October 2026. No trial outcome or sentence for the detained founders was located in open sources as of 29 October 2026. [1][2][5][14][25][27]

Post-Disruption Client Migration

The dominant post-disruption pattern was provider-side infrastructure migration rather than client dispersal: AS210644 IP space shifted to Hypercore's AS211522 within days of sanctions, and successor shells were stood up in Serbia and Uzbekistan. Recorded Future characterized Aeza as "one of the most significant sources of malicious infrastructure" as recently as November 2025, indicating clients largely followed the migrated infrastructure rather than abandoning it. In 2026 the migration reversed: Hypercore was dissolved and unrouted, and the space returned to AS210644 and AS216246 or moved to NetCrafters OÜ, so clients never had to leave the operator. [10][11][25][27]

Connected Groups and Ecosystem Relationships

Each connected-entity claim carries two independent confidence tiers: Tier 1 (infrastructure relationship: did Aeza host their infrastructure?) and Tier 2 (operational relationship: did the Aeza operator know the client's identity or coordinate operationally?). Aeza's no-KYC, reseller-mediated model makes most Tier 2 assessments inference-level, with the notable exceptions of BlackSprut and the SDA, where OFAC/UK evidence indicates operator-level knowledge.

Vendor Attribution Summary

Corroborating vendors across the profile: OFAC, UK FCDO, Australia DFAT, Chainalysis, TRM Labs, Silent Push, Recorded Future/Insikt, Qurium, EU DisinfoLab, CORRECTIV, The Record, abuse.ch (ThreatFox/URLhaus), AbuseIPDB. No public vendor has issued an assessment materially disagreeing with the Aeza-BPH attribution. Vendors that have not published a formal Aeza-specific assessment in this pass: Mandiant, CrowdStrike, Secureworks, Microsoft MSTIC, Team Cymru.

Trajectory Assessment

Infrastructure Churn

Churn is assessed HIGH and deliberate. The defining event was the rapid post-sanctions migration of ~2,100 IPs from AS210644 to the newly allocated AS211522 (Hypercore) within nineteen days, described by Silent Push as "unusually rapid," accompanied by shared-prefix announcement (83.147.192.0/24) confirming continuity. Successor shells were stood up across three jurisdictions (UK, Serbia, Uzbekistan). The second phase, after the November 2025 designations, ran the other way: Hypercore dissolved and went dark (Dec 2025 to Feb 2026), AS210644 was re-homed to the Russian parent's own RIPE LIR record (Mar 2026), former Hypercore space moved to NetCrafters OÜ (Feb 2026), and 57 new IPv4 blocks were registered between July 2025 and October 2026. [10][25][27]

Market Position

Aeza was a large-scale, established BPH operator (~100,000+ IPs at peak) serving a broad portfolio spanning infostealers, ransomware, a major darknet market, and state-aligned disinformation. Recorded Future's November 2025 characterization as "one of the most significant sources of malicious infrastructure" indicates it retained material market weight even after sanctions. Qurium's September 2026 count (about 137,000 addresses, roughly twenty times the 2022 baseline and above the pre-sanctions estimate) shows the footprint has grown, not shrunk, under two rounds of sanctions. [11][25]

Disruption History

Three disruption vectors converged in 2025: Russian criminal arrests (Feb/Apr), tri-lateral sanctions (Jul and Nov), and infrastructure exposure by researchers (Silent Push, Recorded Future, Qurium). None fully terminated operations; the group adapted via migration and rebranding. The EU imposed no sanctions and no server seizures are documented. Reconstitution signals per the RIPE maintainer method: 57 IPv4 blocks registered after the OFAC action, in six clusters, the most recent on 13 October 2026; one direct RIPE NCC IPv6 allocation (object March 2026); and a RIPE NCC LIR record for the sanctioned parent created five weeks after the second designation round. [27]

Mandatory Intelligence Gaps

Recent Reporting

Update Pass (29 October 2026)

Follow-On Verification (July 2026)

Sources