Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Media Land / ML Cloud

calendar Sep 24, 2026  ·
Share on: linkedin copy

Detects inbound mail whose Received-header IP path transits IP space announced by Media Land LLC or its sister company ML Cloud LLC, designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-11-19 (E.O. 13694) for providing bulletproof hosting infrastructure to LockBit, BlackSuit, and Play ransomware operations and DDoS attacks against U.S. critical infrastructure. IP ranges are the prefixes announced by Media Land's ASNs (AS206728, AS215376).

Sublime rule (View on GitHub)

 1name: "Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Media Land / ML Cloud"
 2description: "Detects inbound mail whose Received-header IP path transits IP space announced by Media Land LLC or its sister company ML Cloud LLC, designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-11-19 (E.O. 13694) for providing bulletproof hosting infrastructure to LockBit, BlackSuit, and Play ransomware operations and DDoS attacks against U.S. critical infrastructure. IP ranges are the prefixes announced by Media Land's ASNs (AS206728, AS215376)."
 3references:
 4  - "https://home.treasury.gov/news/press-releases/sb0319"
 5  - "https://www.justice.gov/usao-ndoh/pr/three-russian-nationals-indicted-international-cybercrimes-resulting-more-62m-losses"
 6type: "rule"
 7severity: "high"
 8source: |
 9  type.inbound
10  and any(headers.ips,
11          //
12          // This rule makes use of a beta feature and is subject to change without notice
13          // using the beta feature in custom rules is not suggested until it has been formally released
14          //
15          beta.ip_in(.ip,
16                     "45.141.85.0/24", // AS206728
17                     "91.220.163.0/24", // AS206728
18                     "176.98.187.0/24", // AS215376
19                     "2a0b:7ec0:1320::/48", // AS206728
20                     "2a0b:7ec0:7701::/48" // AS206728
21          )
22  )  
23attack_types:
24  - "Malware/Ransomware"
25  - "Credential Phishing"
26  - "BEC/Fraud"
27tactics_and_techniques:
28  - "Evasion"
29  - "Social engineering"
30detection_methods:
31  - "Header analysis"
32  - "Sender analysis"
33id: "2fda81d2-315b-5d8d-84da-9d01311ca52e"
to-top