🕵️ RESEARCH & DEEP DIVES
- Aeza bulletproof hosting infrastructure survives sanctions under seven new identities
A Qurium investigation finds the sanctioned Russian bulletproof hosting provider Aeza is still operating under seven new legal identities.- Applies to Aeza Group and its successor NetCrafters networks, previously sanctioned by OFAC on July 1, 2025 and targeted in a later US/UK/Australia action.
- Qurium identified eleven legal entities controlling more than two-thirds of Aeza's IP space, including Plant Holding GmbH, Axiom Asia Services, Rapidseedbox, and Andwase Limited.
- Aeza-linked infrastructure has appeared in malware distribution, infostealer, cloaking, online fraud, and the BlackSprut darknet market, and hosted ransomware groups like Medusa and BianLian.
- Aeza's address space grew from about 6,400 IPv4 addresses in 2022 to more than 137,000 across 536 IPv4 /24 networks by 2026.
- The network survived by transferring IP resources to offshore entities controlled by the same people or close partners, evading sanctions and rebranding.
🔓 CVEs & KEV
- CVE-2026-0322 — Palo Alto Networks Cloud NGFW — CVSS 8.6 — And a Palo Alto Networks zero-day too https:// security.paloaltonetworks.com/ CVE-2026-0322.