XRP ETF

Tornado Cash

Tornado

ETF COIN

Authorities in the US, Australia, and the UK have sanctioned the Russia-based bulletproof hosting services provider Zservers for allegedly supplying services to the LockBit crypto ransomware gang.
The sanctions include asset freezes on Zservers and its UK-based front company, XHOST internet Solutions LP, alongside asset freezes and travel bans for six individuals, the US Treasury’s Office of Foreign Assets Control (OFAC) and the UK’s Foreign <a data-ct-non-breakable="null" href="https://www.gov.uk/government/news/new-uk-sanctions-target-russian-cybercrime-network" rel="null" target="null" text="null" title="null">Office</a> <a data-ct-non-breakable="null" href="https://home.treasury.gov/news/press-releases/sb0018" rel="null" target="null" text="null" title="null">said</a> on Feb. 11.&nbsp;
The US Treasury said bulletproof hosting service providers are known to sell a range of tools that can mask locations, identities, and activities online. The department’s acting under-secretary for terrorism and financial intelligence, Bradley Smith, said cybercriminals rely on <a data-ct-non-breakable="null" href="https://cointelegraph.com/explained/crimeware-as-a-service-a-new-threat-to-crypto-users" rel="null" target="null" text="null" title="null">third-party network service providers</a> like Zservers to “enable their attacks on US and international critical infrastructure.”&nbsp;
<figure>
 <img alt="US, UK, Australia sanction Zservers for hosting crypto ransomware LockBit" src="https://s3.cointelegraph.com/uploads/2025-02/0194f806-3688-76d8-90a5-529b9d427ac8" title="">
 <figcaption style="text-align: center;">
 Source: <a data-ct-non-breakable="null" href="https://x.com/FCDOGovUK/status/1889323835771502964" rel="null" target="null" text="null" title="null">Foreign, Commonwealth and Development Office</a>
 </figcaption>
</figure>
Authorities from 10 countries <a data-ct-non-breakable="null" href="https://www.afp.gov.au/news-centre/media-release/international-police-operation-takes-down-worlds-most-harmful-2" rel="null" target="null" text="null" title="null">launched</a> a joint operation to disrupt LockBit in February 2024, alleging the group had caused billions of dollars in damage, including a hack on Australia’s insurance provider Medibank and the Industrial Commercial Bank of China US.&nbsp;
LockBit uses ransomware, a type of malware that encrypts computer files and threatens to either delete or leak them unless the victim pays, usually with cryptocurrency.
Among the six individuals being sanctioned are two Zservers administrators — Russian nationals Alexander Igorevich Mishin and Aleksandr Sergeyevich Bolshakov — who were said to have a role in directing LockBit crypto transactions and supporting the gang’s attacks.
Blockchain analytics firm Chainalysis said in a Feb. 11 <a data-ct-non-breakable="null" href="https://www.chainalysis.com/blog/ofac-sanctions-zservers-ransomware-attacks-lockbit-february-2025/" rel="null" target="null" text="null" title="null">report</a> that a <a data-ct-non-breakable="null" href="https://cointelegraph.com/learn/articles/types-of-bitcoin-addresses" rel="null" target="null" text="null" title="null">crypto address</a> linked to Mishin and three other wallets linked to Zservers are now on OFAC’s Specially Designated Nationals (SDN) list, meaning they’re targeted for special sanctions by the US government.
OFAC had added 44 <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/treasury-donald-trump-tornado-cash-approach" rel="null" target="null" text="null" title="null">Tornado Cash smart contract addresses </a>to the list in August 2022, alleging that individuals had used the mixer to launder more than $7 billion worth of crypto.&nbsp;
Zservers onchain activity reveals that various actors sent funds to Zservers for their services, such as ransomware groups and affiliates, including “multiple different ransomware affiliates — beyond LockBit,” Chainalysis said in its report.&nbsp;
At the same time, the firm said Zservers had cashed out funds at <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/us-sanctions-russia-s-largest-darknet-market-and-crypto-exchange-garantex" rel="null" target="null" text="null" title="null">sanctioned Russian-based exchange Garantex</a>, merchant services and exchanges that don’t enforce Know Your Customer rules.
<figure>
 <img alt="US, UK, Australia sanction Zservers for hosting crypto ransomware LockBit" src="https://s3.cointelegraph.com/uploads/2025-02/0194f808-d778-7194-b956-3b168dcb0ef4" title="">
 <figcaption style="text-align: center;">
 Chainalysis was able to track some of Zservers’ onchain activities and alleged connections to ransomware groups. Source: <a data-ct-non-breakable="null" href="https://www.chainalysis.com/blog/ofac-sanctions-zservers-ransomware-attacks-lockbit-february-2025/" rel="nofollow noopener" target="_blank" text="null" title="https://www.chainalysis.com/blog/ofac-sanctions-zservers-ransomware-attacks-lockbit-february-2025/">Chainalysis</a>
 </figcaption>
</figure>
“In addition to Zservers’ nested infrastructure, we are able to use Reactor to visualize its at least $5.2 million in onchain activity and thorough connectivity to the high-risk and illicit entities,” Chainalysis said.&nbsp;
Related: <a data-ct-non-breakable="null" href="https://cointelegraph.com/news/crypto-ransomware-losses-down-2024-chainalysis" rel="null" target="null" text="null" title="null">Ransomware losses down 35% year-over-year: Chainalysis</a>
Zservers homepage lists servers in the US, Russia, Bulgaria, the Netherlands and Finland, and claims to offer support, equipment, and custom configuration services.
LockBit was first noticed by authorities in September 2019 and is estimated to have extorted up to $1 billion over 7,000 cyberattacks between June 2022 and February 2024.
Magazine: <a data-ct-non-breakable="null" href="https://cointelegraph.com/magazine/altcoin-crypto-season-xrp-etf-filings-hawk-tuah-speaks-out-digest-feb-2-8/" rel="null" target="null" text="null" title="null">Has altseason finished? XRP ETF applications flood in, and more: Hodler’s Digest, Feb. 2 – 8</a>

US, UK, Australia sanction Zservers for hosting crypto ransomware LockBit

Cointelegraph

Other articles published on Feb 12, 2025

Trump’s WLFI launches ’Macro Strategy’ fund for Bitcoin, Ether, altcoins

Solana at $200 or XRP at $2.5: Which Altcoin Can Turn $1000 to $50,000 This Cycle?

Expert Predicts XRP Will Dominate the Crypto Market in 2025

Qubetics Emerges as the Top Crypto Presale for 2025 with High ROI Potential, While Monero and Ste...

Shiba Inu (SHIB) Shows Signs of Coming Breakout. Here’s the Price Target

Toshi.bet Expands Crypto Gaming Platform with Personalized Rewards and Instant Withdrawals

Join our free newsletter for daily crypto updates!