Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Media Land / ML Cloud
Detects inbound mail whose Received-header IP path transits IP space announced by Media Land LLC or its sister company ML Cloud LLC, designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-11-19 (E.O. 13694) for providing bulletproof hosting infrastructure to LockBit, BlackSuit, and Play ransomware operations and DDoS attacks against U.S. critical infrastructure. IP ranges are the prefixes announced by Media Land's ASNs (AS206728, AS215376).
Sublime rule (View on GitHub)
1name: "Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Media Land / ML Cloud"
2description: "Detects inbound mail whose Received-header IP path transits IP space announced by Media Land LLC or its sister company ML Cloud LLC, designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-11-19 (E.O. 13694) for providing bulletproof hosting infrastructure to LockBit, BlackSuit, and Play ransomware operations and DDoS attacks against U.S. critical infrastructure. IP ranges are the prefixes announced by Media Land's ASNs (AS206728, AS215376)."
3references:
4 - "https://home.treasury.gov/news/press-releases/sb0319"
5 - "https://www.justice.gov/usao-ndoh/pr/three-russian-nationals-indicted-international-cybercrimes-resulting-more-62m-losses"
6type: "rule"
7severity: "high"
8source: |
9 type.inbound
10 and any(headers.ips,
11 ip.in_range(.,
12 "45.141.85.0/24", // AS206728
13 "91.220.163.0/24", // AS206728
14 "176.98.187.0/24", // AS215376
15 "2a0b:7ec0:1320::/48", // AS206728
16 "2a0b:7ec0:7701::/48" // AS206728
17 )
18 )
19attack_types:
20 - "Malware/Ransomware"
21 - "Credential Phishing"
22 - "BEC/Fraud"
23tactics_and_techniques:
24 - "Evasion"
25 - "Social engineering"
26detection_methods:
27 - "Header analysis"
28 - "Sender analysis"
29id: "2fda81d2-315b-5d8d-84da-9d01311ca52e"