Zservers Hit with Sanctions for Hosting LockBit’s Ransomware Operations

The sanctions, announced on February 11, apply to Zservers and XHOST Internet Solutions LP, its UK-registered company.

According to the US Treasury’s Office of Foreign Assets Control (OFAC) and the UK’s Foreign Office, six individuals linked to the operation also face asset freezes and travel bans.

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

How to Avoid Major Crypto Investment Risks? (Beginner-Friendly)

SUBSCRIBE

ON YOUTUBE

Officials say companies like Zservers provide anonymous hosting services that cybercriminals use to hide their activities. Bradley Smith, the US Treasury's Under Secretary for Terrorism and Financial Intelligence, noted that hackers depend on such providers to attack critical infrastructure in the US and other countries.

LockBit operates by encrypting victims’ files and demanding payment—typically in cryptocurrency—to restore access or prevent leaks. Two Russian nationals, Alexander Igorevich Mishin and Aleksandr Sergeyevich Bolshakov, have been identified as key figures managing LockBit’s financial transactions through Zservers.

Chainalysis, a blockchain research company, reported on February 11 that a crypto address connected to Mishin, along with three other wallets connected to Zservers, has been added to OFAC’s Specially Designated Nationals list.

Furthermore, investigators found that multiple ransomware groups, not just LockBit, used Zservers for their operations.

The company allegedly moved funds through Garantex, a Russian crypto exchange already under sanctions, as well as other services with weak identity verification controls. Chainalysis estimated that Zservers handled at least $5.2 million in on-chain transactions linked to high-risk activity.

Meanwhile, a US court has fined the founders of EmpiresX, an illegal crypto investment platform. How much was the penalty? Read the full story.