US, Australia, and UK Sanction Russia-Based Bulletproof Hosting Provider Zservers for Ties to LockBit Ransomware Gang

Authorities from the US, Australia, and the UK have imposed sanctions on Zservers, a Russia-based provider of bulletproof hosting services, for allegedly supporting the LockBit crypto ransomware gang. The sanctions involve freezing assets of Zservers and its UK-based front company, XHOST internet Solutions LP, as well as imposing asset freezes and travel bans on six individuals, according to the US Treasury’s Office of Foreign Assets Control (OFAC) and the UK’s Foreign Office on Feb. 11. The US Treasury highlighted that bulletproof hosting service providers offer tools that can conceal locations, identities, and online activities, enabling cybercriminals to target critical infrastructure in the US and internationally. Zservers administrators Alexander Igorevich Mishin and Aleksandr Sergeyevich Bolshakov, along with other individuals, have been sanctioned for their involvement in directing LockBit crypto transactions and supporting the gang's attacks. Chainalysis reported that Zservers received funds from various actors, including ransomware groups and affiliates, and cashed out funds at a sanctioned Russian-based exchange, Garantex.