sublimehighRule

Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Media Land / ML Cloud

Detects inbound mail whose Received-header IP path transits IP space announced by Media Land LLC or its sister company ML Cloud LLC, designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-11-19 (E.O. 13694) for providing bulletproof hosting infrastructure to LockBit, BlackSuit, and Play ransomware operations and DDoS attacks against U.S. critical infrastructure. IP ranges are the prefixes announced by Media Land's ASNs (AS206728, AS215376).

MITRE ATT&CK

T1566.001 T1204.002 T1486 T1566 T1566.002 T1598 T1534 T1656 T1036 T1027

defense-evasioninitial-access

Detection Query

type.inbound
and any(headers.ips,
        ip.in_range(.,
                    "45.141.85.0/24", // AS206728
                    "91.220.163.0/24", // AS206728
                    "176.98.187.0/24", // AS215376
                    "2a0b:7ec0:1320::/48", // AS206728
                    "2a0b:7ec0:7701::/48" // AS206728
        )
)

Data Sources

Email MessagesEmail HeadersEmail Attachments

Platforms

References

Raw Content

name: "Observed IOC: Mail transiting OFAC-sanctioned bulletproof host Media Land / ML Cloud"
description: "Detects inbound mail whose Received-header IP path transits IP space announced by Media Land LLC or its sister company ML Cloud LLC, designated by the U.S. Treasury's Office of Foreign Assets Control (OFAC) on 2025-11-19 (E.O. 13694) for providing bulletproof hosting infrastructure to LockBit, BlackSuit, and Play ransomware operations and DDoS attacks against U.S. critical infrastructure. IP ranges are the prefixes announced by Media Land's ASNs (AS206728, AS215376)."
references:
  - "https://home.treasury.gov/news/press-releases/sb0319"
  - "https://www.justice.gov/usao-ndoh/pr/three-russian-nationals-indicted-international-cybercrimes-resulting-more-62m-losses"
type: "rule"
severity: "high"
source: |
  type.inbound
  and any(headers.ips,
          ip.in_range(.,
                      "45.141.85.0/24", // AS206728
                      "91.220.163.0/24", // AS206728
                      "176.98.187.0/24", // AS215376
                      "2a0b:7ec0:1320::/48", // AS206728
                      "2a0b:7ec0:7701::/48" // AS206728
          )
  )
attack_types:
  - "Malware/Ransomware"
  - "Credential Phishing"
  - "BEC/Fraud"
tactics_and_techniques:
  - "Evasion"
  - "Social engineering"
detection_methods:
  - "Header analysis"
  - "Sender analysis"
id: "2fda81d2-315b-5d8d-84da-9d01311ca52e"