From Darknet to Disinfo: How a ‘Bulletproof’ Russian Host Evades EU Sanctions
Illustration: YouTube 2025-12-04
Illustration: YouTube 2025-12-04
The Russian server hosting company Aéza is known for its involvement in the pro-Kremlin Doppelganger disinformation campaign, which spread propaganda through look-alike clones of major news outlets. In November, the company was sanctioned by the United States, Australia, and the United Kingdom for its cooperation with cybercriminals. But even before that, Russian authorities had charged its founders with operating a darknet drug marketplace. Europe — where Aéza has operated servers — has so far taken no action.
The latest report by the research lab Recorded Future described Aéza as “one of the most significant sources of malicious infrastructure.” In an earlier statement to the Czech investigative outlet investigace.cz and German investigative Correctiv, the domain hosting company rejected the allegations and claimed it complies with all legal requirements.
Aéza’s resellers advertised its services as “bulletproof.” In this context, the term “bulletproof” refers to a type of internet hosting deliberately designed to withstand government intervention, blocking, or legal takedown requests. Providers of bulletproof hosting often tolerate — or even actively support — the illegal activities of their clients, such as the operation of darknet markets and phishing sites, promotion of ransomware campaigns, or hosting of illicit content.
According to Andrey Sochnikov, editor-in-chief of the investigative department Systema at Radio Free Europe/Radio Liberty (RFE/RL), so-called bulletproof hosting services are among the most popular offerings on Russian-language hacking forums. “In the Russian environment, this creates a paradoxical situation. For many years, the authorities have tried to fully control all internet traffic inside the country, yet they still don’t completely understand how that traffic actually works. This has created space for an entire layer of smaller hosting providers that offer criminal groups convenient infrastructure for very little money — often paid in cryptocurrency — and after one or two operations it can simply be abandoned,” Sochnikov explains.
The servers are often located in Russia, Ukraine, the Baltic states, or in offshore jurisdictions. “The likelihood that their services are used not only by ordinary fraudsters but also by actors linked to the Kremlin is quite high. One only has to recall the case of the Altai-based provider King Servers, whose infrastructure was used to carry out attacks on US election systems in 2016,” he adds.
An “Apolitical” Aéza
When it comes to its target clientele, Aéza is remarkably permissive — it takes everyone. Since the start of the full-scale war in Ukraine, the company has described its business approach as strictly apolitical. On social media, it claims to work with any customer interested in its services, whether Russian, Western, or Ukrainian. “We are ready to provide support to any projects that suffer damage because of the geopolitical tensions between two states,” the company declared on the day the Russian invasion began.
When investigace.cz asked whether Aéza would provide hosting services to opposition groups or banned organizations in Russia, co-founder Arseny Penzev replied without hesitation that, for Aéza, they are no different from any other client. “If we receive a complaint from Roskomnadzor [the Russian censorship authority], we forward it to the client. That is where our mission ends.” According to him, they handle every report of abuse in exactly the same way.
When Russian authorities began throttling YouTube in the summer of 2024, Aéza launched a campaign promoting VPN services that allowed users to bypass Roskomnadzor’s blocks and continue watching videos at normal quality. At the same time, however, the company was providing infrastructure for disinformation websites — so-called doppelgangers, or look-alike sites that mimic Western news outlets while spreading pro-Kremlin content aimed at manipulating public opinion in Europe and the United States.
No-action Europe
In November 2025, Aéza was added to the lists of sanctioned entities in the United Kingdom, Australia, and the United States.
“Cybercriminals continue to rely heavily on bulletproof hosting providers like Aéza Group, who make it easier for them to conduct various types of attacks, steal U.S. technologies, and sell drugs on the black market,” says Bradley T. Smith, then acting US Deputy Secretary of the Treasury for Terrorism and Financial Intelligence.
Aéza is still not on the European sanctions list and can therefore continue operating in Europe. Investigace.cz contacted the European Commission to ask whether it intends to impose sanctions on Aéza, but it declined to comment on the matter.
Qurium Media Foundation, a Swedish non-profit that has extensively documented online disinformation, expresses frustration with the EU’s lack of action. “Organizations like Aéza — enabled by connectivity suppliers such as Aurologic in Germany — continue operating malicious infrastructure. Whenever the US Department of the Treasury issues sanctions, the infrastructure is quickly transferred to new legal entities within days. The European Union and its member states have shown a troubling lack of political will to confront these actors and the methods they use to remain online.”
The foundation continues, “despite our efforts to investigate and document how infrastructure is weaponized against European citizens, we still fail to understand what prevents policymakers from taking proportional action against known actors who profit from these kinds of abuses.”
Drug Marketplace in Russia
The company’s legal troubles, however, began earlier, in the first half of 2025. On April 1, a district court in Moscow announced that several senior managers and employees of Aéza had been arrested in Russia. Among them were the company’s co-founders, Arseny Penzev and Yuri Bozoyan. They were charged with participation in a criminal organization and with large-scale illegal trafficking in narcotic substances.
According to Russian authorities and an analysis by Qurium, Aéza had been providing hosting services used to run BlackSprut, one of the world’s largest darknet marketplaces. Between January and September 2025 alone, transactions on BlackSprut amounted to $ 1.85 billion.
In the past, however, BlackSprut operated in Russia in a surprisingly public manner. In February 2023, an electronic billboard advertising the illegal marketplace appeared in streets of Moscow. The screen displayed a woman in a cyberpunk mask and fetish-style clothing with the caption: “Come to me if you’re looking for the best.” No information has ever emerged about who ordered the billboard or who approved it.
Advertisement for BlackSprut, one of the largest illegal drug and weapons markets in Moscow | Source: Recorded Future.
In an earlier statement to investigace.cz, Aéza claimed it was unaware that BlackSprut was using its infrastructure. “This marketplace was a client of our reseller. But we terminated our contract with them because of the large number of reports we received from Spamhaus — a service that monitors spam and criminal cyber activities,” explains co-founder Arseny Penzev, who was among those arrested in the spring of 2025. However, according to IT law specialists we consulted, legal liability may extend to the original hosting providers, not just the resellers.
According to reporting by the St. Petersburg daily Fontanka, Penzev’s arrest was preceded by a raid on Aéza’s St. Petersburg branch. The company’s management is registered at an address that once housed the headquarters of the Wagner mercenary group led by Yevgeny Prigozhin. Until his death in August 2023, Prigozhin also oversaw the notorious “troll factory,” the Internet Research Agency (IRA). According to available information, however, no evidence has emerged of any direct link between Aéza and structures associated with Prigozhin.
The hosting service remains operational. Investigace.cz contacted Aéza’s press office requesting comment on its current activities in light of the sanctions and the criminal investigation in Russia, but no response had been received by the time this article was published.
The Czech version of this article was published on Investigace cz.
Subscribe to Goulash, our original VSquare newsletter that delivers the best investigative journalism from Central Europe straight to your inbox!
