Zservers Sanctions Expose How Bulletproof Hosting Fuels Crypto Ransomware Operations

On February 11, 2025, the United States Department of the Treasury’s Office of Foreign Assets Control (OFAC), alongside the United Kingdom’s Foreign Commonwealth and Development Office (FCDO) and Australia’s Department of Foreign Affairs and Trade (DFAT), jointly sanctioned Zservers, a Russia-based bulletproof hosting provider, for its role in supporting LockBit ransomware attacks. The coordinated action targeted not only the company itself but also two Russian nationals — Aleksandr Sergeyeevich Bolshakov and Alexander Igorevich Mishin — along with three cryptocurrency addresses and a U.K. front company, XHOST Internet Solutions LP. This landmark enforcement action reveals a critical but often overlooked layer of the crypto crime ecosystem: the infrastructure providers that make ransomware operations possible.

The Exploit Mechanics

LockBit has historically been one of the most prolific Ransomware-as-a-Service (RaaS) groups in the world. The gang operates by developing ransomware tools and licensing them to affiliate attackers, who then deploy the malware against targets ranging from hospitals to financial institutions. LockBit was disrupted in a large, coordinated U.S.-U.K. takedown in February 2024, but its infrastructure and affiliate network have continued to pose a significant threat.

Zservers served as a critical enabler in this ecosystem. As a bulletproof hosting provider, Zservers allowed customers to pay for web hosting anonymously and was generally lenient on the content clients could host. According to the OFAC designation, Zservers had servers located in Russia, Bulgaria, the Netherlands, the United States, and Finland, offering server administration, support, equipment, and custom configuration services. The company also maintained aliases used to advertise its services on dark web forums, making it a one-stop shop for ransomware operators who needed reliable, anonymous infrastructure.

Affected Systems

The sanctions specifically targeted the financial infrastructure underpinning Zservers’ operations. Three cryptocurrency addresses associated with the company were added to OFAC’s Specially Designated Nationals (SDN) list, effectively freezing any assets held in those wallets and prohibiting U.S. persons from transacting with them. The U.K. Government characterized Zservers as “a key component of the Russian cybercrime supply chain” that “provides vital infrastructure for cybercriminals as they plan and execute attacks against the UK.”

Ransomware attacks have been a persistent priority for cybersecurity policy across the affected nations. Hospitals in the U.K. have been targeted by ransomware attacks, and the economic damage from these operations runs into the billions of dollars annually. Bitcoin, trading at approximately $95,747 on February 11, 2025, remains the primary payment rail for ransomware demands, though privacy coins and mixing services complicate tracing efforts.

The Mitigation Strategy

The coordinated sanctions represent a significant escalation in how governments are targeting the infrastructure layer of cybercrime, not just individual threat actors. By designating the hosting provider itself — and its front companies — the U.S., U.K., and Australia are signaling that providing services to ransomware groups carries real consequences, even if those providers claim ignorance of how their services are used.

For the crypto industry, the implications are substantial. Exchanges and wallet providers must now screen transactions against the newly added SDN addresses. Chainalysis, which provided on-chain analysis supporting the sanctions designation, has highlighted the growing role of blockchain analytics in identifying and disrupting ransomware financial networks. Ethereum, priced at approximately $2,602 on this date, also features in ransomware payment flows, particularly through decentralized exchanges and bridges.

Lessons Learned

The Zservers sanctions underscore several critical lessons for the cryptocurrency and cybersecurity communities. First, the threat landscape extends far beyond individual hackers or hacking groups — it includes an entire supply chain of service providers who knowingly or negligently facilitate criminal activity. Second, international coordination between law enforcement and regulatory bodies is becoming more sophisticated, with on-chain analysis playing an increasingly central role in building cases for sanctions and prosecutions. Third, the continued use of cryptocurrency as a ransomware payment mechanism means that the industry must invest heavily in compliance tools and transaction monitoring systems.

User Action Required

Cryptocurrency users and businesses should take immediate steps to ensure compliance with the new sanctions designations. Check all wallet addresses against the updated SDN list, particularly the three addresses associated with Zservers. Exchanges should update their transaction screening systems and train compliance teams on the new designations. Businesses that rely on third-party hosting providers should conduct due diligence to ensure they are not inadvertently using services connected to sanctioned entities. Finally, anyone involved in cryptocurrency transactions should maintain awareness of OFAC compliance requirements, as violations can result in severe civil and criminal penalties.

Disclaimer: This article is for informational purposes only and does not constitute legal or financial advice. Always consult with qualified professionals regarding compliance obligations.