Russian Provider Zservers Sanctioned for Aiding LockBit

The United States, Australia, and the United Kingdom have imposed sanctions on the Russian secure hosting provider Zservers for offering services to the LockBit ransomware group.

? SANCTIONED: Russian cyber entity ZSERVERS, the launchpad for crippling ransomware attacks, and their UK front, XHOST Internet Solutions LP.

The UK is cracking down on the Russian cybercrime supply chain and the predatory ransomware activity it feeds. pic.twitter.com/AzE80qrxMT

— Foreign, Commonwealth & Development Office (@FCDOGovUK) February 11, 2025

According to data from the OFAC, the company, with servers in the US, Russia, Bulgaria, the Netherlands, and Finland, sold a range of tools that allowed users to conceal their location, identity, and online activities. This facilitated “attacks on critical infrastructure in the US and worldwide.” 

The sanctions include freezing the assets of Zservers, its UK front company XHOST Internet Solutions LP, and six individuals. 

Among them are two Zservers administrators, Russian citizens Alexander Mishin and Alexander Bolshakov. Authorities allege they were involved in managing LockBit’s cryptocurrency transactions and supporting the gang’s attacks.

Chainalysis analysts reported that wallets associated with Zservers and the Mishins have been added to the SDN list. Funds from various illicit entities, including other ransomware affiliates, were directed to the provider’s addresses.

Zservers cashed out funds through the US-sanctioned Russian exchange Garantex, as well as on trading services and platforms without KYC, analysts noted.

Overall, experts identified on-chain activity by Zservers linked to high-risk and illegal entities amounting to at least $5.2 million. 

During a joint operation by authorities from dozens of countries to disrupt LockBit’s activities, part of the ransomware’s infrastructure was seized, 200 cryptocurrency wallets were arrested, and several gang members were detained. Law enforcement estimates that from June 2022 to February 2024, 7,000 cyberattacks generated up to $1 billion for the hackers.

As reported by Chainalysis, ransomware revenues in 2024 fell from $1.25 billion to $813 million.