"Allies Target Russian Hosting Giant Zservers for Aiding LockBit Ransomware"

The United States, United Kingdom, and Australia have imposed sanctions on Russia-based hosting service Zservers for providing services to the notorious cryptocurrency ransomware gang LockBit. The joint action, announced on February 11, includes asset freezes, travel bans, and restrictions that cut Zservers off from the global financial system.

Zservers, a bulletproof hosting service provider, offered infrastructure designed to shield cybercriminals from law enforcement by masking identities, locations, and online activities. According to authorities, the company's administrators, Alexander Igorevich Mishin and Aleksandr Sergeyevich Bolshakov, provided bulletproof hosting to cyber criminals and reassigned infrastructure to LockBit affiliates to help them evade detection. Mishin also directed cryptocurrency transactions tied to ransomware operations, including payments for Zservers' services used by multiple ransomware groups.

The sanctions also blacklist Mishin, Bolshakov, and four other individuals tied to LockBit's operations, cutting them off from global financial systems and imposing travel bans. A separate report from blockchain analytics firm Chainalysis revealed that Zservers catered to a broad client base in the cybercrime world, with at least $5.2 million in on-chain activity linked to the service. The report also noted that Zservers cashed out through sanctioned Russian exchange Garantex and other high-risk platforms with little to no KYC enforcement.

The LockBit ransomware group, first spotted in 2019, has been behind some of the biggest hacks and crypto extortion cases, including attacks on Bangkok Airways, Accenture, and Canadian government services. In February 2024, a global law enforcement coalition dismantled LockBit's operational network by seizing its command and control systems. In December of that year, the U.S. Department of Justice charged a Russian national for working as a developer for the ransomware group.