← Aeza Groupreviewed 2026-10-16 · 20 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Aeza Group against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
1 claimThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #16[disputed][awaiting moderator]in section: Sanctions Evasion and Continued Operations
“Investigative reporting by VSquare.org noted that Aeza continued registering new domains daily even while operating under sanctions, and that its infrastructure remained partly accessible within the European Union.”
reviewerVSquare.org reported Aeza continued registering new domains daily even while sanctioned, and that its infrastructure remained partly accessible within the EU.The specific 'continued registering new domains daily' detail is not present in the cited VSquare article and could not be corroborated elsewhere; the 'partly accessible' characterization also overstates what is a straightforward 'not sanctioned in the EU, so can operate there' finding.Proposed correction (not yet applied)Investigative reporting by VSquare.org noted that Aeza's infrastructure remained accessible within the European Union because the entity had not been added to EU sanctions lists.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #11[unverifiable][awaiting moderator]in section: BlackSprut Darknet Marketplace
“Russian investigative accounts indicate the investigation was triggered after an undercover officer purchased 4.19 grams of mephedrone through the marketplace.”
reviewerThe investigation into BlackSprut was triggered after an undercover officer purchased 4.19 grams of mephedrone through the marketplace.A general figure of 'over four grams' is corroborated by The Record, but no source I could access gives the specific 4.19-gram figure the page states. Not contradicted, just unconfirmed at that precision. - #13[unverifiable][awaiting moderator]in section: Arrests of Leadership by Russian Authorities
“The following individuals were arrested: co-founders Arseniy Penzev and Yuri Bozoyan, along with employees Maxim Orel, Tatyana Zubova, Georgy Lavrukhin, and Technical Director Vladimir Gasta.”
reviewerPenzev, Bozoyan, Maxim Orel, Tatyana Zubova, Georgy Lavrukhin and Technical Director Vladimir Gast were all arrested in the April 2025 raid.Penzev, Bozoyan, Orel and Zubova as arrestees are corroborated across multiple sources (also matching Russian court-record reporting found via search). No source consulted names Georgy Lavrukhin, and none confirms Technical Director Vladimir Gast was arrested — OFAC's July 2025 designation describes Gast as still serving as technical director months later, which is not inherently inconsistent with an April arrest, but his arrest itself is unconfirmed.
partially supported
5 claimsThe cited evidence supports part of the claim but not all of it.
- #5[partially supported][awaiting moderator]in section: OFAC Sanctions — July 2025
“OFAC also designated one TRON cryptocurrency address associated with the entity (TU4tDFRvcKhAZ1jdihojmBWZqvJhQCnJ4F), which Chainalysis reported had received more than $350,000 in cryptocurrency, with funds cashed out at multiple global exchanges including connections to the previously sanctioned Garantex exchange.”
reviewerOFAC designated the TRON address TU4tDFRvcKhAZ1jdihojmBWZqvJhQCnJ4F, which Chainalysis says received more than $350,000 in crypto, cashed out at exchanges with connections to the previously-sanctioned Garantex exchange.The dollar figure and wallet role are accurate; the Garantex connection is real but one hop removed from how the sentence reads, which implies a more direct link. - #6[partially supported][awaiting moderator]in section: Multilateral Sanctions — November 2025
“On November 19, 2025, OFAC, Australia's Department of Foreign Affairs and Trade (DFAT), and the UK's Foreign, Commonwealth & Development Office (FCDO) jointly announced a second round of sanctions targeting Aeza Group's sanctions evasion infrastructure.”
reviewerOn November 19, 2025, OFAC, Australia's DFAT and the UK's FCDO jointly sanctioned Hypercore Ltd., Datavice MCHJ, Smart Digital Ideas DOO, and individuals Maksim Makarov and Ilya Zakirov as Aeza's evasion network.Every fact stated about Aeza's part of the Nov 19 action is accurate, but the page's framing omits that the action was broader and centered on a different, unrelated bulletproof hosting operator (Media Land). This is a coverage/framing issue rather than a factual error. - #14[partially supported][awaiting moderator]in section: Arrests of Leadership by Russian Authorities
“Penzev and Bozoyan were charged under Articles 210 and 228.1 of the Russian Criminal Code for participation in an organized criminal group and large-scale drug trafficking.”
reviewerPenzev and Bozoyan were charged under Articles 210 and 228.1 of the Russian Criminal Code for organized criminal group participation and large-scale drug trafficking.None of the page's four cited sources state the specific statute numbers 210/228.1. Independent web search found a Russian legal-news report (rapsinews.ru, via anti-malware.ru) citing Article 210 part 2 and complicity under Article 228.1 for one defendant, consistent with the page — but other reporting (citing Kommersant/Fontanka) describes the lead charges as illegal banking activity (Art. 172) plus organized crime (Art. 210), without drug trafficking. The organized-crime and drug-trafficking framing is more likely correct on balance, but the specific statute citation is not fully settled across sources. - #15[partially supported][awaiting moderator]in section: Arrests of Leadership by Russian Authorities
“Following the arrests, part-owner Igor Knyazev assumed operational control of the entity, and security researchers noted that Aeza's services continued operating with, according to reports, 'no significant changes.'”
reviewerFollowing the arrests, part-owner Igor Knyazev assumed operational control of the entity.The Knyazev operational-control claim is supported. The direct quote 'no significant changes' attributed to unnamed 'security researchers'/'reports' could not be located in any of the page's cited sources or in independent search; the underlying idea (continued operation) is supported, but the specific quoted phrase is not traceable to a source. - #17[partially supported][awaiting moderator]in the timeline
“CEO Arsenii Penzev and General Director Yurii Bozoyan allegedly begin providing technical infrastructure services to the BlackSprut darknet drug marketplace.”
reviewerCEO Penzev and GD Bozoyan allegedly began providing BlackSprut with technical infrastructure services in 2023 (timeline entry sourced to U.S. Treasury OFAC).The 2023 date is widely repeated by credible research firms, so it is plausible, but the page's timeline attributes it directly to 'U.S. Treasury OFAC' when the date's actual origin (per the research firms that discuss it) is secondary Telegram-channel reporting. This is a provenance/attribution nuance rather than a likely-wrong date.
confirmed
12 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Entity Overview
“Following what Russian sources described as a 'hack' of MskHost in September 2021, the group rebranded sequentially under the names 'ЕНОТКЛАУД' (Enotcloud), then 'ПАРТНЕР' in November 2021, and finally 'АЕЗА ГРУПП' (Aeza Group) in November 2022.”
reviewerAeza Group's name history: founded via MskHost, rebranded to Enotcloud after a September 2021 'hack', then to Partner (Nov 2021), then to Aeza Group (Nov 2022).Qurium's own page notes a minor internal inconsistency (AS re-registration to 'Partner LLC' in Dec 2022 and 'Aeza Group LLC' in March 2024), likely reflecting legal-entity paperwork lag behind the branding changes the page describes; does not contradict the core claim. - #2[confirmed][no action needed]in section: Entity Overview
“Aeza's Saint Petersburg headquarters was located in the former Wagner PMC Center.”
reviewerAeza's Saint Petersburg headquarters was located in the former Wagner PMC Center.Directly corroborated. - #3[confirmed][no action needed]in section: Entity Overview
“A UK-registered subsidiary, Aeza International Ltd., was used to lease IP addresses to cybercriminal clients.”
reviewerA UK-registered subsidiary, Aeza International Ltd., was used to lease IP addresses to cybercriminal clients.Confirmed by the Treasury press release itself. - #4[confirmed][no action needed]in section: OFAC Sanctions — July 2025
“On July 1, 2025, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) designated Aeza Group LLC and four affiliated entities under Executive Order 13694 (as amended by E.O. 14144 and 14306), citing cyber-enabled activities threatening U.S. national security, foreign policy, and economic health.”
reviewerOn July 1, 2025, OFAC designated Aeza Group LLC and four affiliated entities under E.O. 13694 (as amended), coordinated with the UK's NCA; entities and the four named individuals (Penzev, Bozoyan, Gast, Knyazev) were designated as described.Fully matches the primary regulatory source. - #7[confirmed][no action needed]in section: Hosted Cybercriminal Operations
“Meduza infostealer operators, who targeted U.S. defense and technology companies among other victims globally, relied on Aeza servers.”
reviewerBianLian ransomware, RedLine infostealer, Meduza infostealer and Lumma infostealer operators used Aeza's bulletproof hosting infrastructure; Meduza and Lumma specifically targeted U.S. defense and technology companies.Confirmed directly against the primary source. - #8[confirmed][no action needed]in section: Hosted Cybercriminal Operations
“Additional malware families identified by Qurium Media Foundation within Aeza network prefixes include Aurora, SystemBC, and AsyncRat.”
reviewerQurium identified Aurora, SystemBC and AsyncRat malware within Aeza network prefixes.Confirmed. - #9[confirmed][no action needed]in section: Hosted Cybercriminal Operations
“Aeza also allegedly hosted the Doppelganger pro-Kremlin influence operation's front domains beginning in July 2022, operating from the same network ranges as the malware command-and-control servers.”
reviewerAeza hosted Doppelganger front domains beginning in July 2022, co-located with malware C2 infrastructure.Confirmed. - #10[confirmed][no action needed]in section: BlackSprut Darknet Marketplace
“According to OFAC and the Qurium Media Foundation, Aeza protected BlackSprut from Denial-of-Service attacks for approximately two years.”
reviewerAeza protected BlackSprut from DDoS attacks for approximately two years.Confirmed. - #12[confirmed][no action needed]in section: BlackSprut Darknet Marketplace
“BlackSprut operated through approximately 16 front-end domains (including bs2best[.]at and bs2c[.]io) across IP addresses primarily within Aeza's AS210352 and AS211409 networks.”
reviewerBlackSprut operated through approximately 16 front-end domains (including bs2best[.]at and bs2c[.]io) primarily within Aeza's AS210352 and AS211409 networks.Confirmed with moderate confidence on AS211409 specifically. - #18[confirmed][no action needed]in section: Doppelganger Disinformation Infrastructure
“Aeza Group allegedly hosted infrastructure for the Doppelganger disinformation campaign, a Russian state-aligned influence operation active since at least May 2022.”
reviewerDoppelganger is a Russian state-aligned influence operation active since at least May 2022, publishing fake articles mimicking Der Spiegel and The Guardian.Confirmed. - #19[confirmed][no action needed]in section: Sanctions Evasion and Continued Operations
“Within ten days of the initial designation, Hypercore Ltd. was registered in the UK and assigned autonomous system number AS211522. By July 20, 2025, security researchers at Silent Push detected IP ranges migrating from Aeza's original AS210644 to AS211522, which had already accumulated over 2,100 IP addresses.”
reviewerWithin ten days of the July 1, 2025 OFAC designation, Hypercore Ltd. was registered in the UK and assigned AS211522; by July 20, 2025 Silent Push detected migration from AS210644 with over 2,100 IPs already present.Confirmed, including the corresponding timeline[8] and timeline[9] entries. - #20[confirmed][no action needed]in section: Multilateral Sanctions — November 2025
“Three new shell companies were designated: Hypercore Ltd. (UK, AS211522, allocated July 10, 2025), to which Aeza began migrating IP ranges by July 20, 2025; Datavice MCHJ (Uzbekistan, established July 2025); and Smart Digital Ideas DOO (Serbia).”
reviewerThe November 2025 action designated Hypercore Ltd., Datavice MCHJ, Smart Digital Ideas DOO, and individuals Maksim Makarov and Ilya Zakirov.Confirmed; note Treasury's release calls Hypercore a 'front company' and describes the other two as designated for acting for/supporting Aeza, rather than using the page's blanket term 'shell companies' for all three — a minor characterization choice, not a factual error.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.