In a coordinated move, the United States, the United Kingdom, and Australia have jointly sanctioned the Russia-based hosting provider Zservers for its role in enabling the notorious ransomware group LockBit. The announcement, made on February 11, highlights a firm international stance against cybercrime infrastructure.

Zservers, known as a "bulletproof" hosting provider, has long catered to cybercriminals by shielding their activities from law enforcement, masking identities, and rerouting operations to avoid detection. The sanctions impose significant penalties, including freezing assets, banning travel, and severing ties with the global financial system. Financial institutions engaging with Zservers or its affiliates risk severe penalties, amplifying the crackdown's reach.

The joint action also targets Zservers administrators Alexander Igorevich Mishin and Aleksandr Sergeyevich Bolshakov, along with four others linked to LockBit. Authorities allege that these individuals provided essential infrastructure to cybercriminals, facilitating ransomware operations worldwide. Mishin is further accused of overseeing cryptocurrency transactions for ransomware payments, directly tying Zservers' services to illicit activity.

Blockchain analytics firm Chainalysis has revealed that Zservers handled over $5.2 million in on-chain activity, catering to a wide range of cybercriminal clients beyond LockBit. The platform also used high-risk exchanges like Garantex, known for minimal compliance with anti-money laundering laws, to cash out illicit proceeds.

Zservers’ association with the LockBit ransomware group underscores its importance in global cybercrime. LockBit, operational since 2019, has executed high-profile ransomware attacks against entities such as Bangkok Airways, Accenture, and Canadian government services. Despite significant law enforcement efforts, including a coalition that dismantled LockBit’s operational network in 2024, the group's infrastructure remains a challenge for authorities worldwide.

The recent sanctions, which also blacklist cryptocurrency wallets associated with Zservers, mark an escalated effort to disrupt ransomware networks at their roots. By targeting the infrastructure that facilitates such operations, authorities aim to curb the growing threats to critical systems and financial institutions globally.