A significant data breach occurred when an unidentified threat actor leaked internal data from Medialand, a major bulletproof hosting (BPH) provider with extensive ties to cybercriminal operations worldwide. ????️ On March 28, 2025, a threat actor leaked internal data from Medialand, a major bulletproof hosting (BPH) provider long linked to Yalishanda (LARVA-34). The leaked information exposes the infrastructure that has been enabling a wide spectrum of malicious activities, including ransomware deployment, phishing campaigns, and data exfiltration operations. The leaked data allows for pattern analysis that may reveal operational signatures unique to specific threat actors, enhancing the cybersecurity community’s ability to identify and track malicious campaigns even as actors attempt to change their techniques. PRODAFT researchers identified a pattern of preparatory activities preceding the leak, noting that the threat actor created a dedicated Telegram channel on February 23, 2025, likely in preparation for the eventual data release. The hosting service has been instrumental in maintaining servers for various cybercriminal enterprises, including code-signing systems, phishing kits, data exfiltration panels, and ransomware infrastructure associated with groups like BlackBasta. Medialand has long been linked to the notorious threat actor known as Yalishanda (also tracked as LARVA-34), providing critical infrastructure for advanced threat operations. The implications extend beyond immediate operational disruption, potentially enabling law enforcement and security researchers to establish connections between previously unlinked campaigns and threat actors based on shared infrastructure. Security analysts can now correlate indicators of compromise (IOCs) across seemingly disparate campaigns, potentially leading to the partial or complete de-anonymization of threat actors who believed their operations were secure. The exposed data encompasses records up until February 2025 and contains detailed information about server purchases, payment records (including cryptocurrency transactions), and potentially personally identifiable information of Medialand’s clients. The timeline suggests careful planning, with the leak following a February 11 BlackBasta data exposure and a March 14 update from Yalishanda on a known underground forum.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 08 Apr 2025 11:45:18 +0000