Aeza Group
Summary
Aeza Group LLC is a Russia-based bulletproof hosting (BPH) provider headquartered in Saint Petersburg, sanctioned by the U.S. Treasury's OFAC on July 1, 2025 for knowingly providing server infrastructure to ransomware operators, infostealer campaigns, and the BlackSprut darknet drug marketplace. Its founders were arrested by Russian authorities in April 2025 on drug trafficking and organized crime charges, and a second round of multilateral sanctions by the U.S., UK, and Australia in November 2025 targeted the shell companies Aeza established to evade the initial designation.
Connected Entities
2 entities · 10 linked investigations- TU4tDFRvcKhAZ1jdihojmBWZqvJhQCnJ4F→mentioned with→Aeza Group(50%)
- + 2 more
Timeline(11 events)
2019-01-01
Arseniy Penzev and Yuri Bozoyan begin working together at Russian hosting company MskHost, laying the groundwork for their future operations.
Qurium Media Foundation2021-09-01
MskHost is reported to have been 'hacked'; the founders subsequently rebrand and establish new hosting operations under the name Enotcloud.
Qurium Media Foundation2021-11-01
Entity rebrands to 'ПАРТНЕР' (Partner), continuing hosting operations.
Qurium Media Foundation2022-07-01
Aeza network infrastructure begins hosting early front domains for the Doppelganger pro-Kremlin disinformation campaign, co-located with malware C2 servers.
Qurium Media Foundation2022-11-01
Entity formally rebrands to 'АЕЗА ГРУПП' (Aeza Group LLC), the name under which it will be sanctioned.
Qurium Media Foundation2023-01-01
CEO Arsenii Penzev and General Director Yurii Bozoyan allegedly begin providing technical infrastructure services to the BlackSprut darknet drug marketplace.
U.S. Treasury OFAC2025-04-01
Russian FSB and law enforcement raid Aeza Group's Saint Petersburg headquarters. Co-founders Penzev and Bozoyan, along with four other employees, are arrested on charges of participation in an organized criminal group and large-scale drug trafficking related to BlackSprut.
The Record from Recorded Future News2025-07-01
OFAC designates Aeza Group LLC, Aeza International Ltd. (UK), Aeza Logistic LLC, Cloud Solutions LLC, and four individuals (Penzev, Bozoyan, Gast, Knyazev) under Executive Order 13694. One TRON cryptocurrency address (TU4tDFRvcKhAZ1jdihojmBWZqvJhQCnJ4F) is also designated. Action coordinated with the UK's National Crime Agency.
U.S. Department of the Treasury2025-07-10
Hypercore Ltd. is registered in the UK and assigned autonomous system AS211522, alleged to be a front company established to migrate Aeza's IP infrastructure and evade the July 1 sanctions.
Silent Push2025-07-20
Security researchers at Silent Push detect mass migration of Aeza Group IP ranges from AS210644 to Hypercore's AS211522, with over 2,100 IP addresses already present in the new autonomous system.
Silent Push2025-11-19
OFAC, Australia's DFAT, and the UK's FCDO jointly sanction Aeza Group's evasion infrastructure: Hypercore Ltd. (UK), Datavice MCHJ (Uzbekistan), Smart Digital Ideas DOO (Serbia), and two additional individuals — Maksim Makarov and Ilya Zakirov.
U.S. Department of the TreasuryDecision Log
- #1publish⛓ pending7/31/2026, 5:05:48 PMhash: 9h37s5MrAq4BpmYcTW5hev5MGYEdBYre1uajzUyEFSjF
12 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/31/2026, 5:05:32 PM
last updated: 7/31/2026, 7:05:11 PM
avoid.net — verified advice for a post-truth world