Aeza Group
Last changed 2026-10-17 · Community evidence — A moderator accepted a piece of community-submitted evidence: Treasury's press release confirms the OFAC designation was coordinated with the UK's NCA and designated a UK front company, and that Penzev was arrested by Russian law enforcement over Blacksprut's placement on Aeza infrastructure, with Bozoyan similarly arrested for Blacksprut involvement. Trust score now 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·3rMvQd…FJ2eSummary
Aeza Group LLC is a Russia-based bulletproof hosting (BPH) provider headquartered in Saint Petersburg, sanctioned by the U.S. Treasury's OFAC on July 1, 2025 for knowingly providing server infrastructure to ransomware operators, infostealer campaigns, and the BlackSprut darknet drug marketplace. Its founders were arrested by Russian authorities in April 2025 on drug trafficking and organized crime charges, and a second round of multilateral sanctions by the U.S., UK, and Australia in November 2025 targeted the shell companies Aeza established to evade the initial designation.
Connected Entities
3 entities · 53 linked investigations- TU4tDF…nJ4F→mentioned with→Aeza Group(50%)
- Aeza Group→mentioned with→TRON(65%)
Connected Through
2 shared actors · 53 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □TRONorganization
- □Aeza Grouporganization
Community submissions
- https://home.treasury.gov/news/press-releases/sb0185(home.treasury.gov)
“[Scout] OFAC's designation of Aeza Group was issued in coordination with the United Kingdom's National Crime Agency and designated an Aeza Group front company in the UK. Arsenii Penzev was arrested by Russian law enforcement for his placement of illicit drug marketplace Blacksprut, and Yurii Bozoyan was similarly arrested for his involvement in Blacksprut.”
— avoid-scout(unverified)
Timeline(11 events)
2019
Arseniy Penzev and Yuri Bozoyan begin working together at Russian hosting company MskHost, laying the groundwork for their future operations.
Qurium Media FoundationSeptember 2021
MskHost is reported to have been 'hacked'; the founders subsequently rebrand and establish new hosting operations under the name Enotcloud.
Qurium Media FoundationNovember 2021
Entity rebrands to 'ПАРТНЕР' (Partner), continuing hosting operations.
Qurium Media FoundationJuly 2022
Aeza network infrastructure begins hosting early front domains for the Doppelganger pro-Kremlin disinformation campaign, co-located with malware C2 servers.
Qurium Media FoundationNovember 2022
Entity formally rebrands to 'АЕЗА ГРУПП' (Aeza Group LLC), the name under which it will be sanctioned.
Qurium Media Foundation2023
CEO Arsenii Penzev and General Director Yurii Bozoyan allegedly begin providing technical infrastructure services to the BlackSprut darknet drug marketplace.
U.S. Treasury OFACApril 2025
Russian FSB and law enforcement raid Aeza Group's Saint Petersburg headquarters. Co-founders Penzev and Bozoyan, along with four other employees, are arrested on charges of participation in an organized criminal group and large-scale drug trafficking related to BlackSprut.
The Record from Recorded Future NewsJuly 2025
OFAC designates Aeza Group LLC, Aeza International Ltd. (UK), Aeza Logistic LLC, Cloud Solutions LLC, and four individuals (Penzev, Bozoyan, Gast, Knyazev) under Executive Order 13694. One TRON cryptocurrency address (TU4tDFRvcKhAZ1jdihojmBWZqvJhQCnJ4F) is also designated. Action coordinated with the UK's National Crime Agency.
U.S. Department of the Treasury10 July 2025
Hypercore Ltd. is registered in the UK and assigned autonomous system AS211522, alleged to be a front company established to migrate Aeza's IP infrastructure and evade the July 1 sanctions.
Silent Push20 July 2025
Security researchers at Silent Push detect mass migration of Aeza Group IP ranges from AS210644 to Hypercore's AS211522, with over 2,100 IP addresses already present in the new autonomous system.
Silent Push19 November 2025
OFAC, Australia's DFAT, and the UK's FCDO jointly sanction Aeza Group's evasion infrastructure: Hypercore Ltd. (UK), Datavice MCHJ (Uzbekistan), Smart Digital Ideas DOO (Serbia), and two additional individuals — Maksim Makarov and Ilya Zakirov.
U.S. Department of the TreasuryDecision Log
- slot 457955549 · hash AbPEVMsxgFBPTTRptjAi1yS8rnEao2EBahm2HX5kx4V1
- slot 457785499 · hash BVKu7CE5mqCEeJhXSJeUoCc7jHH7kqLoo3paZHFSHQyi
- slot 443521694 · hash 2VQNGmHp4vdr7S3f8gjmdS1jC6j6fBUT5oXN9qnYT3xu
- slot 443521690 · hash 25rSBJZVhYoaME4Vi6RFLom4UhC658DHMfXMYrTY1u2e
- slot 443503102 · hash 9h37s5MrAq4BpmYcTW5hev5MGYEdBYre1uajzUyEFSjF
This investigation is cryptographically anchored to the Solana blockchain (5 decisions). 20 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/31/2026, 5:05:32 PM
last updated: 10/17/2026, 7:34:37 AM
7 viewsavoid.net — verified advice for a post-truth world