Executive Summary and Provider Overview

Quick-Reference Attributes

Overall Assessment

Aeza Group is a St. Petersburg-based bulletproof hosting (BPH) provider that presented publicly as a low-cost, high-performance VPS/VDS and dedicated-server business while functioning as core infrastructure for ransomware, infostealer, darknet-market, and Russian state-aligned disinformation operations. OFAC, which designated the group on 1 July 2025, described Aeza as a BPH service that "allows cybercriminals to avoid law enforcement while renting IP addresses, servers and domains" and specifically named the Meduza and Lumma infostealer operators, BianLian ransomware, RedLine infostealer panels, and the BlackSprut darknet drug marketplace as hosted activity. [1]

The provider is the assessed successor to MskHost, a predecessor BPH brand founded circa 2019 by Yurii Bozoyan and taken offline by hacktivists in September 2021. Aeza Group LLC was incorporated in June 2021 with Bozoyan, Arsenii Penzev, and Igor Knyazev each holding 33%. Its business model deliberately routed criminal clients through a downstream reseller chain (LetHost, ZeroHost, and others), which advertised the "bulletproof" property to end users while Aeza maintained plausible deniability at the core ASN level. [1][14][15]

Aeza is assessed as Degraded rather than defunct. Russian authorities arrested Penzev, Bozoyan, and Gast in February/April 2025 (charged with narcotics and organized-crime offenses tied to BlackSprut, not cybercrime), and OFAC/UK/Australia sanctions followed. Within nineteen days of the July 2025 OFAC action, Silent Push detected roughly 2,100 IP addresses migrating from AS210644 to the newly registered AS211522 (Hypercore Ltd), and the November 2025 tri-lateral action designated Hypercore plus Serbian and Uzbek successor shells and two additional operators (Makarov, Zakirov). The European Union imposed no sanctions, and Recorded Future described Aeza as "one of the most significant sources of malicious infrastructure" as recently as November 2025. The single largest structural leverage point remains the group's dependency on German upstream aurologic GmbH for its European footprint. [2][10][11][14]

Silent Push // IOFA Migration Detection

Silent Push IOFA (Indicators of Future Attack) feed detecting the automated reclassification of Aeza infrastructure from AS210644 to the newly registered AS211522 (Hypercore Ltd) on 20 July 2025, nineteen days after the OFAC designation.

Silent Push, July 2025

Silent Push // Shared Prefix Evidence

BGP data (via bgp.tools) showing the 83.147.192.0/24 subnet announced by both AS210644 (Aeza) and AS211522 (Hypercore), supporting the attribution of the successor ASN. Example migrated host: 83.147.192[.]5.

Silent Push / bgp.tools, July 2025

Silent Push // AS211522 Allocation Data

Silent Push Total View data confirming AS211522 was allocated on 10 July 2025 and already contained over 2,100 IP addresses, an unusually rapid ramp-up for a newly allocated autonomous system.

Silent Push, July 2025

TRM Labs // On-Chain Wallet Graph

TRM Labs on-chain analysis graph published alongside the November 2025 coordinated sanctions, illustrating fund flows across the Russian BPH ecosystem and intermediary wallets tied to bulletproof hosting operators.

TRM Labs, November 2025

U.S. Treasury // OFAC Designation

U.S. Department of the Treasury. OFAC press release SB0185 (1 July 2025) designated Aeza Group, Aeza International Ltd, Aeza Logistic LLC, Cloud Solutions LLC, and four Aeza leaders for enabling ransomware, infostealer, and darknet-market operations.

U.S. Treasury / OFAC, July 2025

Lineage and Organizational Heritage

Predecessor and Sibling Analysis

Aeza is assessed as the direct successor to MskHost (MSK.host), a bulletproof and abuse-tolerant hosting provider founded circa 2019 by Yurii Bozoyan and known for launching DDoS attacks against competing hosts. MskHost was taken offline by hacktivists "who had enough" in September 2021, per researcher compilation at aeza-gang.com and corroborating forum records. The same operator pool, principally Bozoyan and Penzev, incorporated Aeza Group LLC on 17 June 2021 and marketed a public launch date of 26 December 2021. [15]

Brand, Entity, and Sibling Structure

Additional UK entities identified by researchers as part of the network include AEZA GROUP LIMITED (Co. 15065828), AEZATRADE LIMITED (Co. 15172068), and QWINS LTD (Co. 16072422). Researcher-identified sibling ASNs include AS210352 (Partner LLC), AS211409 (Shelter LLC), AS209224 (CYBERHUB-AS), and AS216319 (CHROMIS IT LTD). [15]

Operator Profiles

Six individuals have been sanctioned across the July and November 2025 actions; three were arrested by Russian law enforcement in early 2025. All are Russian nationals. The escalated operator module appears above the fold in Section 01. Detailed profiles follow.

2.1 Yurii Meruzhanovich Bozoyan

2.2 Arsenii Aleksandrovich Penzev

2.3 Vladimir Vyacheslavovich Gast

2.4 Igor Anatolyevich Knyazev

2.5 Maksim Vladimirovich Makarov

2.6 Ilya Vladislavovich Zakirov

Non-Designated Front Persons

Marat Timurov (Uralsk, M. Ihsanov str. 45, Kazakhstan) is identified by researchers as the nominal front person for Aeza International Ltd (UK Co. 15109642); not OFAC-designated as of the record date. Separately, open reporting attributes the registration of Hypercore Ltd to a "Patryk Drozda" two days after the July 2025 sanctions. [SINGLE SOURCE] This registrant name should be treated as CREDIBLE pending Companies House corroboration; it does not appear in the OFAC designation text. [15]

Disputed Assessments

Penzev publicly disputed the Doppelgänger and state-nexus allegations (see Section 03 verbatim copy), and Aeza's official agent characterized reseller connections (LetHost/ZeroHost) as mere IP-transit relationships terminated after complaints. These claims are contradicted by (a) OFAC's finding that Bozoyan and Penzev "began to provide Blacksprut with services in 2023," and (b) forum evidence of identical server hardware appearing simultaneously at Aeza and the resellers. The name "Yuri" vs. "Yurii" for Bozoyan varies between OFAC (Yurii) and secondary reporting; treated as the same individual. [1][14][15]

Operational and Business Model

Service Model

Aeza publicly marketed itself as a high-performance, affordable VPS/VDS and dedicated-server provider for legitimate customers, developers, and VPN users. Advertised products included KVM VPS on AMD Ryzen 9 7950X3D/9950X with NVMe storage from roughly €4.94/month, dedicated Threadripper and i9-class servers from about €200/month, anti-DDoS on all plans, and locations spanning Moscow, St. Petersburg, Stockholm, Helsinki, Amsterdam, Vienna, Paris, Frankfurt/Falkenstein, London, Hong Kong, and Los Angeles. Behind this commercial face, OFAC assessed Aeza as a de facto BPH provider that "allows cybercriminals to avoid law enforcement while renting IP addresses, servers and domains used for disseminating malware, supporting darknet markets and carrying out other tasks related to fraud and cyberattacks." [1]

Plausible deniability was maintained by routing malicious clients through a downstream reseller chain rather than direct onboarding (see reseller chain below). This architecture is the primary mechanism by which Aeza insulated its core ASNs from direct attribution. [1][14]

Verbatim Advertising Copy

Pricing (Documented Examples)

Onboarding

Aeza operated an open-signup model with no identity verification. A third-party review site documented that "the service supports anonymous registration, no real-name verification, and accepts cryptocurrency payments." Penzev framed equal treatment of all clients (including censorship-evading and opposition-linked projects) as a neutral, apolitical posture; no vetting of client intent was performed. [14]

Downstream Reseller Chain

• LetHost / ZeroHost ran "on your hardware" per direct LowEndTalk accusations. A forum participant reported contacting St. Petersburg law enforcement about the Aeza connection in 2022 and being told "in Russia it is not forbidden to keep such hosting." The FBI reportedly later shut down LetHost. Aeza's agent claimed these were merely IP-transit clients cut off after complaints, disputed by evidence of identical hardware at both operations. [14][19]
• TNSecurity Ltd (UK): researcher-identified downstream distributor running "prefix swapping with AEZA."
• Shelter LLC (AS211409): hosted C2 for Lumma, Meduza, and Mystic stealers.
• Doppelgänger's European infrastructure was accessed through this chain, with Aeza upstream while UK shells (TNSecurity, Liber Systems) appeared as direct operators. [12][13]

Russian IT-law specialists consulted by investigace.cz noted that "legal liability may extend to the original hosting providers, not just the resellers." [14]

Abuse Handling and LE Posture

Stated posture: "We always respond to all complaints" (Aeza agent, July 2024); Penzev: "If we receive a complaint from Roskomnadzor, we forward it to the client." Documented behavior contradicts this: Aeza hosted BlackSprut for roughly two years before Russian action; Spamhaus flagged LetHost/ZeroHost-linked subnets; and OFAC found Bozoyan and Penzev "began to provide Blacksprut with services in 2023." Penzev's claim that Aeza terminated the BlackSprut reseller "because of the large number of reports we received from Spamhaus" is directly contradicted by the OFAC finding. Support ran via a 24/7 Telegram bot (@aezasupport_bot), a ticket panel, and RIPE abuse contacts abuse@aeza.net / abuse@aeza.ru. [1][14]

OPSEC

Multi-jurisdiction incorporation (RU LLC, UK Ltd, plus post-sanctions Serbia and Uzbekistan shells), reseller abstraction, anonymous crypto/e-wallet payments, and separation between Russian-controlled hardware and European delivery infrastructure. The principal OPSEC failure was operator concentration in Russia: all six designated operators are Russian nationals, and three founders were arrested domestically. [1][2][14]

Technical Capabilities and Infrastructure Footprint

Autonomous Systems

RIPE abuse contact (AS210644): abuse@aeza.net. Registration verification: AS210644, AS216246, and AS211522 registrations and the AS210644→AS211522 IP migration are corroborated across Silent Push, bgp.tools, IPinfo, and RIPEstat references. Registered technical organization for AS210644 is Aeza International LTD (Sheffield, UK). [10][16][24]

IP Ranges and Geographic Footprint

• AS210644 (Aeza International): primary footprint in Sweden, with additional presence in the Netherlands and Germany, plus smaller footprints in 10+ countries (Finland, Austria, France, UK). [10][11]
• AS216246 (Aeza Group): Russia-registered; ~26 IPv4 prefixes, ~6,656 addresses (late 2025).
• Ecosystem total (pre-migration): ~100,000+ IPs; Qurium estimated Doppelgänger-associated infrastructure at 300+ prefixes and 100,000 IPs. [12]
• Migrated example host: 83.147.192[.]5 (subnet 83.147.192.0/24 announced by both AS210644 and AS211522). [10]

Physical data centers: Europe (primary) - aurologic GmbH facility, Robert-Bosch-Str. 25, 63225 Langen, Germany; Russia - Moscow and St. Petersburg nodes (directly controlled). European servers are primarily sourced through Hetzner resale and aurologic colocation. [11][15]

Upstream Transit Provider Chain

Resilience Techniques

• Rapid ASN registration: AS211522 (Hypercore) allocated 10 Jul 2025, nine days after sanctions, with 2,100+ IPs within ten days. [10]
• Front-company rotation to hold IP space and RIPE registration independent of the Russian parent.
• Reseller abstraction insulating core ASNs from direct attribution.
• Multi-jurisdiction incorporation (RU, UK, Serbia, Uzbekistan).
• Anti-DDoS on all plans; Gast linked to botnet-based DDoS capability.
• Anonymous payment methods (crypto, QIWI, PerfectMoney, YouMoney) reducing KYC trails.

Hosted Activity Types

Blocklist Standing

Delisting history: No documented delisting attempts or successful delistings. Aeza's stated position was that complaints were forwarded to clients; no documented engagement with Spamhaus delisting procedures for the ASN-DROP entry. [16]

Known Weaknesses and Single Points of Failure

• aurologic dependency: the entire European delivery path transits aurologic GmbH; coordinated pressure would sever the European footprint. aurologic resisted through November 2025 citing "infrastructure neutrality." [11]
• UK corporate registration: successive UK shells (Aeza International, Hypercore, AEZATRADE, QWINS) are Companies House entities subject to UK OFSI designation, which acted rapidly in November 2025.
• Russian operator vulnerability: all confirmed operators are Russia-based nationals; three founders are in pre-trial detention.
• TRON wallet exposure: the designated TRON address was publicly identified; successor payment channels (Zakirov-established) are not yet publicly traced.
• IP-space visibility: ASN-DROP makes AS210644 ranges trivially blockable at BGP by any network implementing Spamhaus DROP feeds. [16][23]

Financial Infrastructure

Payment Methods

Advertised methods included Bitcoin, USDT (TRC20/BEP20/ERC20/TON), Litecoin, Dogecoin, BTC Cash, ETH, SOL, BNB, TRX, TON, USDC; bank cards ("of any country"); PayPal (via support); and the Russian e-wallets QIWI, YouMoney (formerly Yandex.Money), and PerfectMoney. WebMoney and SteamPay were observed in third-party reviews. Forum users noted that Russian-only payment methods carried low fees while international methods carried ~10% fees, interpreted as evidence that operations were financially centered in Russia. [18][14]

Designated Cryptocurrency Address

Three-Phase Laundering Model

Source: Chainalysis and TRM Labs analyses of the designated TRON address (1 July 2025). [7][8]

Phase 1 - Acquisition: Aeza used an intermediary payment processor to receive hosting fees, obscuring direct traceability. The designated TRON address functioned as an administrative/cash-out wallet rather than the primary customer-facing deposit address, so total inflow is likely larger than the $350,000 visible. Direct payments from infostealer vendors matched Aeza service pricing; regular payment pathways ran through Garantex (per TRM Labs).

Phase 2 - Layering: Funds routed through intermediary addresses before cash-out. Garantex (OFAC-sanctioned March 2025, disrupted by US/Germany/Finland) served as a layering node. Chainalysis also noted connections to "an escrow service used for selling items on a popular gaming platform," an unusual pattern that may represent deliberate obfuscation using legitimate-seeming transaction flows.

Phase 3 - Extraction: Regular cash-out points to global cryptocurrency exchanges and payment-service providers. Chainalysis Reactor graphs showed deposit addresses receiving funds from multiple sources including Garantex and an infostealer vendor. No OTC broker relationships were specifically documented in available public sources.

Post-sanctions payment infrastructure: per OFAC (19 Nov 2025), Ilya Zakirov "helped establish new companies and payment methods to obfuscate Aeza's continuing activity." Specific successor addresses are not yet publicly documented. [2]

Sanctions and Risk Designations

• Garantex: OFAC-sanctioned April 2022; disrupted March 2025; operators indicted (E.D. Va.). Aeza flows confirmed to transit Garantex. [8]
• TRON address: on the OFAC SDN List since 1 July 2025.
• No VASP-level designation specifically for Aeza's payment processor has been identified.

Client Profile and Hosted Operations

Crimeware Verticals by Evidence Tier

Client Geography and Target Profile

Aeza's infrastructure was physically distributed across Western Europe (Germany, Sweden, Netherlands, Finland, Austria) while operator leadership was exclusively Russian (St. Petersburg), creating a deliberate jurisdictional split: European server locations gave reduced latency for European/US-targeted campaigns while operator liability remained in Russia, where enforcement was absent until 2025. No confirmed CIS exclusion policy is documented, though Aeza's marketing emphasized service to Russian users evading censorship. [1][14]

Notable Hosted Cases

Case 1 - BlackSprut Darknet Drug Market (2023–2025)

Primary infrastructure host and anti-DDoS backbone. BlackSprut was described as one of the world's largest darknet marketplaces; Jan–Sep 2025 transaction volume was estimated at $1.85 billion. OFAC: "Aeza Group has also hosted … BlackSprut, a Russian darknet marketplace for illicit drugs." Gast "oversaw the technical details of placing Blacksprut on Aeza Group infrastructure." Bozoyan and Penzev were arrested Feb/Apr 2025 and charged under Articles 210 and 228.1 (up to 20 years). [1]

Case 2 - Meduza and Lumma Infostealers (2023–2025)

C2 hosting and IP provisioning via Aeza International (UK). OFAC: these operators "used the hosting service to target the U.S. defense industrial base and technology companies." Lumma infected ~10 million systems before its May 2025 takedown. IOC: 147.45.78[.]8:80 (Meduza C2, AS210644). OFAC: "Aeza International serves as a front company to lease IP addresses to cybercriminals, including Meduza infostealer operators." [1]

Case 3 - Doppelgänger Disinformation (2022–2025)

Core European infrastructure hub hosting fake sites impersonating Der Spiegel, The Guardian, Le Monde and others across 10+ countries. The Record (July 2024): "At the core of Doppelgänger's operation in Europe and Russia is a company called Aeza." UK FCDO designated Aeza for "provision of 'bulletproof hosting services' to the Social Design Agency (SDA)." Qurium scale: 300+ prefixes, 100,000+ IPs, ~€5M market value, ~€50,000/month leasing cost - "can only be sustained by serious financial support from external actors." [5][12][13]

Case 4 - BianLian Ransomware

Infrastructure host for the double-extortion group. Confirmed by OFAC and CyberScoop; no specific IPs or timeframes documented in open sources. [1][22]

State Nexus Assessment

Positive Evidence

• Direct SDA client relationship (strongest indicator): UK FCDO confirmed Aeza "provided 'bulletproof hosting services' to the Social Design Agency (SDA)," an entity "tasked and funded directly by the Russian State" implementing campaigns "at the direction of the Russian Presidential Administration." [5]
• Doppelgänger financing scale: 300+ prefixes, 100,000+ IPs, ~€50,000/month "can only be sustained by serious financial support from external actors" (Qurium/EU DisinfoLab). [12]
• Wagner Center co-location: Aeza's St. Petersburg office was in a building that served as the Wagner Center until 2023. No direct evidentiary link between Aeza and Wagner structures has emerged; geographic co-location is noted only.
• Selective non-enforcement: Aeza operated with apparent impunity in Russia for ~4 years (2021–2025) despite public BPH documentation; Russian action came only via narcotics law (BlackSprut), not cybercrime or malicious-infrastructure hosting.
• Timing: analysts have questioned whether the arrests represent genuine law enforcement or internal reorganization of the security apparatus (aeza-gang.com). [15]

Negative Evidence and Limitations

• No confirmed direct state control: no evidence that operators are FSB/GRU/SVR personnel or that the entity is state-operated. It presents as a commercially motivated criminal enterprise that accepted state-adjacent clients (SDA) among a broader portfolio.
• Genuine RU criminal jeopardy: the arrests of Bozoyan and Penzev are inconsistent with an entity under active state protection, though the charges relate to narcotics, not the cyber/disinformation activity of primary interest.
• Penzev's public "apolitical" claims: more consistent with plausible-deniability commercialism than a witting state asset (not conclusive).
• EU non-action: the absence of any EU sanctions despite servers in Germany, Sweden, and the Netherlands is notable; drivers are not determinable from available evidence.

Law Enforcement and Regulatory Response

Arrests, Sanctions, and Seizures

Three founders (Bozoyan, Penzev, Gast) were arrested and remain in Russian pre-trial detention on narcotics/organized-crime charges. Sanctions span three authorities (US, UK, Australia) across two rounds. No infrastructure seizure by any EU member state has been documented; European servers at aurologic/Hetzner facilities remained partially accessible as of December 2025. [1][2][5][14]

Post-Disruption Client Migration

The dominant post-disruption pattern was provider-side infrastructure migration rather than client dispersal: AS210644 IP space shifted to Hypercore's AS211522 within days of sanctions, and successor shells were stood up in Serbia and Uzbekistan. Recorded Future characterized Aeza as "one of the most significant sources of malicious infrastructure" as recently as November 2025, indicating clients largely followed the migrated infrastructure rather than abandoning it. [10][11]

Connected Groups and Ecosystem Relationships

Each connected-entity claim carries two independent confidence tiers: Tier 1 (infrastructure relationship: did Aeza host their infrastructure?) and Tier 2 (operational relationship: did the Aeza operator know the client's identity or coordinate operationally?). Aeza's no-KYC, reseller-mediated model makes most Tier 2 assessments inference-level, with the notable exceptions of BlackSprut and the SDA, where OFAC/UK evidence indicates operator-level knowledge.

Vendor Attribution Summary

Corroborating vendors across the profile: OFAC, UK FCDO, Australia DFAT, Chainalysis, TRM Labs, Silent Push, Recorded Future/Insikt, Qurium, EU DisinfoLab, CORRECTIV, The Record, abuse.ch (ThreatFox/URLhaus), AbuseIPDB. No public vendor has issued an assessment materially disagreeing with the Aeza-BPH attribution. Vendors that have not published a formal Aeza-specific assessment in this pass: Mandiant, CrowdStrike, Secureworks, Microsoft MSTIC, Team Cymru.

Trajectory Assessment

Infrastructure Churn

Churn is assessed HIGH and deliberate. The defining event was the rapid post-sanctions migration of ~2,100 IPs from AS210644 to the newly allocated AS211522 (Hypercore) within nineteen days, described by Silent Push as "unusually rapid," accompanied by shared-prefix announcement (83.147.192.0/24) confirming continuity. Successor shells were stood up across three jurisdictions (UK, Serbia, Uzbekistan). [10]

Market Position

Aeza was a large-scale, established BPH operator (~100,000+ IPs at peak) serving a broad portfolio spanning infostealers, ransomware, a major darknet market, and state-aligned disinformation. Recorded Future's November 2025 characterization as "one of the most significant sources of malicious infrastructure" indicates it retained material market weight even after sanctions. [11]

Disruption History

Three disruption vectors converged in 2025: Russian criminal arrests (Feb/Apr), tri-lateral sanctions (Jul and Nov), and infrastructure exposure by researchers (Silent Push, Recorded Future, Qurium). None fully terminated operations; the group adapted via migration and rebranding. The EU imposed no sanctions and no server seizures are documented.

Mandatory Intelligence Gaps

Recent Reporting

Follow-On Verification (July 2026)

Sources