XRP ETF

Tornado Cash

Tornado

ETF COIN

Authorities in the US, Australia, and the UK have sanctioned the Russia-based bulletproof hosting services provider Zservers for allegedly supplying services to the LockBit crypto ransomware gang.
The sanctions include asset freezes on Zservers and its UK-based front company, XHOST internet Solutions LP, alongside asset freezes and travel bans for six individuals, the US Treasury’s Office of Foreign Assets Control (OFAC) and the UK’s Foreign <a href="https://www.gov.uk/government/news/new-uk-sanctions-target-russian-cybercrime-network" rel="noopener noreferrer nofollow" target="null">Office</a> <a href="https://home.treasury.gov/news/press-releases/sb0018" rel="noopener noreferrer nofollow" target="null">said</a> on Feb. 11.&nbsp;
The US Treasury said bulletproof hosting service providers are known to sell a range of tools that can mask locations, identities, and activities online. The department’s acting under-secretary for terrorism and financial intelligence, Bradley Smith, said cybercriminals rely on <a href="https://cointelegraph.com/explained/crimeware-as-a-service-a-new-threat-to-crypto-users" rel="noopener noreferrer nofollow" target="null">third-party network service providers</a> like Zservers to “enable their attacks on US and international critical infrastructure.”&nbsp;
<figure>
 <img alt="US, UK, Australia sanction Zservers for hosting crypto ransomware LockBit" src="https://s3.cointelegraph.com/uploads/2025-02/0194f806-3688-76d8-90a5-529b9d427ac8" title="">
 <figcaption style="text-align: center;">
 Source: <a href="https://x.com/FCDOGovUK/status/1889323835771502964" rel="noopener noreferrer nofollow" target="null">Foreign, Commonwealth and Development Office</a>
 </figcaption>
</figure>
Authorities from 10 countries <a href="https://www.afp.gov.au/news-centre/media-release/international-police-operation-takes-down-worlds-most-harmful-2" rel="noopener noreferrer nofollow" target="null">launched</a> a joint operation to disrupt LockBit in February 2024, alleging the group had caused billions of dollars in damage, including a hack on Australia’s insurance provider Medibank and the Industrial Commercial Bank of China US.&nbsp;
LockBit uses ransomware, a type of malware that encrypts computer files and threatens to either delete or leak them unless the victim pays, usually with cryptocurrency.
Among the six individuals being sanctioned are two Zservers administrators — Russian nationals Alexander Igorevich Mishin and Aleksandr Sergeyevich Bolshakov — who were said to have a role in directing LockBit crypto transactions and supporting the gang’s attacks.
Blockchain analytics firm Chainalysis said in a Feb. 11 <a href="https://www.chainalysis.com/blog/ofac-sanctions-zservers-ransomware-attacks-lockbit-february-2025/" rel="noopener noreferrer nofollow" target="null">report</a> that a <a href="https://cointelegraph.com/learn/articles/types-of-bitcoin-addresses" rel="noopener noreferrer nofollow" target="null">crypto address</a> linked to Mishin and three other wallets linked to Zservers are now on OFAC’s Specially Designated Nationals (SDN) list, meaning they’re targeted for special sanctions by the US government.
OFAC had added 44 <a href="https://cointelegraph.com/news/treasury-donald-trump-tornado-cash-approach" rel="noopener noreferrer nofollow" target="null">Tornado Cash smart contract addresses </a>to the list in August 2022, alleging that individuals had used the mixer to launder more than $7 billion worth of crypto.&nbsp;
Zservers onchain activity reveals that various actors sent funds to Zservers for their services, such as ransomware groups and affiliates, including “multiple different ransomware affiliates — beyond LockBit,” Chainalysis said in its report.&nbsp;
At the same time, the firm said Zservers had cashed out funds at <a href="https://cointelegraph.com/news/us-sanctions-russia-s-largest-darknet-market-and-crypto-exchange-garantex" rel="noopener noreferrer nofollow" target="null">sanctioned Russian-based exchange Garantex</a>, merchant services and exchanges that don’t enforce Know Your Customer rules.
<figure>
 <img alt="US, UK, Australia sanction Zservers for hosting crypto ransomware LockBit" src="https://s3.cointelegraph.com/uploads/2025-02/0194f808-d778-7194-b956-3b168dcb0ef4" title="">
 <figcaption style="text-align: center;">
 Chainalysis was able to track some of Zservers’ onchain activities and alleged connections to ransomware groups. Source: <a href="https://www.chainalysis.com/blog/ofac-sanctions-zservers-ransomware-attacks-lockbit-february-2025/" rel="noopener noreferrer nofollow" target="_blank">Chainalysis</a>
 </figcaption>
</figure>
“In addition to Zservers’ nested infrastructure, we are able to use Reactor to visualize its at least $5.2 million in onchain activity and thorough connectivity to the high-risk and illicit entities,” Chainalysis said.&nbsp;
Related: <a href="https://cointelegraph.com/news/crypto-ransomware-losses-down-2024-chainalysis" rel="noopener noreferrer nofollow" target="null">Ransomware losses down 35% year-over-year: Chainalysis</a>
Zservers homepage lists servers in the US, Russia, Bulgaria, the Netherlands and Finland, and claims to offer support, equipment, and custom configuration services.
LockBit was first noticed by authorities in September 2019 and is estimated to have extorted up to $1 billion over 7,000 cyberattacks between June 2022 and February 2024.
Magazine: <a href="https://cointelegraph.com/magazine/altcoin-crypto-season-xrp-etf-filings-hawk-tuah-speaks-out-digest-feb-2-8/" rel="noopener noreferrer nofollow" target="null">Has altseason finished? XRP ETF applications flood in, and more: Hodler’s Digest, Feb. 2 – 8</a>

US, UK, Australia sanction Zservers for hosting crypto ransomware LockBit

Cointelegraph

Other articles published on Feb 12, 2025

Join our free newsletter for daily crypto updates!