Feds Sanction Russian Cybercrime Bulletproof Hosting Service

U.S., U.K. and Australian authorities sanctioned a Russian bulletproof hosting service used by cybercriminals and ransomware groups. Zservers’ hosting service, based in Barnaul, Russia, has been advertised in criminal forums as a tool for evading law enforcement investigations and takedowns, as well as investigations by cybersecurity firms.

See Also: OnDemand | North Korea’s Secret IT Army and How to Combat It

Zservers clients include the LockBit ransomware group, which used IP addresses leased by the service to coordinate and launch ransomware attacks. On Tuesday, the U.S. Department of Treasury, the Australian Department of Foreign Affairs and Trade, and the British Foreign Commonwealth and Development Office issued a joint sanction against the service.

“Today’s trilateral action underscores our collective resolve to disrupt all aspects of this criminal ecosystem, wherever located, to protect our national security,” said Bradley Smith, acting undersecretary of the Treasury for Terrorism and Financial Intelligence.

Authorities also sanctioned six Russian employees of Zservers, including two administrators of the platforms. Under the sanctions, banks and individuals are barred from making any financial transactions with sanctioned entities.

In addition to leasing the service, Zservers administrators Alexander Mishin and Aleksandr Bolshakov made cryptocurrency transfers to facilitate multiple cybercrimes, authorities said.

In 2023, when a Lebanese company reached out to the pair to shut down an IP address associated with a LockBit ransomware attack, they shut down the IP address but continued to support LockBit activities by assigning different IP addresses, the authorities said.

As part of the latest action, British authorities also shuttered a Zservers front company called XHOST that enabled ransomware hacks in the country. The Australian authorities said Zservers provided infrastructure support to host stolen data from the hack of MediBank, the country’s largest provider of private health insurance.

Last year, the three governments sanctioned Russian national Aleksandr Gennadievich Ermakov for his role in the 2022 MediBank hack (See: Australia, US, UK Sanction Russian Over 2022 Medibank Breach).

The disruption of the hosting service comes months after law enforcement agencies dismantled LockBit ransomware servers, which further helped authorities to identify malware infrastructure used by the group, as well as a number of its affiliates (See: LockBit Infrastructure Seized by US, UK Police).

The EU and U.S. governments in recent months have expanded their use of cybersecurity sanctions in an effort to tackle cybercrimes more efficiently.