The UK is issuing a series of fresh sections against key players in the Russian cyber-crime supply chain.

The new sanctions target ZSERVERS and six of its members, as well as its UK front company, XHOST Internet Solutions LP. ZSERVERS provide vital infrastructure for cyber-criminals as they plan and execute attacks against the UK.

The illicit supply chain protects, supports, and conceals the operations of some of the world’s most ruthless ransomware gangs. Ransomware actors rely on these services to launch attacks, extort victims and store stolen data.

In the modern digital-first economy, cybersecurity is a non-negotiable cornerstone of business success, the government says. A secure digital economy would be a less attractive target for cyber-criminals and a more attractive home for investment, generating jobs and putting more money into hardworking people’s pockets, which the UK hopes will deliver on its government’s Plan for Change.

“Putin has built a corrupt mafia state driven by greed and ruthlessness,” foreign secretary David Lammy said. “It is no surprise that the most unscrupulous extortionists and cyber-criminals run rampant from within his borders.

“This government will continue to work with partners to constrain the Kremlin and the impact of Russia’s lawless cyber underworld. We must counter their actions at every opportunity to safeguard the UK’s national security and deliver on our Plan for Change.”

Predatory ransomware groups pose a clear and persistent threat to national security, public services and privacy.

These attacks threaten critical national infrastructure, disrupt essential services, compromise sensitive data and generated $1 billion from their victims globally in 2023 alone.

“Ransomware attacks by Russian affiliated cybercrime gangs are some of the most harmful cyber threats we face today and the government is tackling them head on,” minister of state for security, Dan Jarvis said.

“Denying cyber-criminals the tools of their trade weakens their capacity to do serious harm to the UK.

“We have already announced new world-first proposals to deter ransomware attacks and destroy their business model.

“With these targeted sanctions and the full weight of our law enforcement, we are countering the threats we face to protect our national security, a foundation of our Plan for Change, and our economy.”

Recommended reading

• NCA Targets Russian Networks Laundering Ransomware Profits
• Lockbit Tries to Relaunch Following Global Police Takedown
• LockBit 3.0 Dethroned and New Players are Emerging

ZSERVERS explicitly advertise themselves to illicit actors as a Bulletproof Hosting (BPH) Provider.

Some BPH are known to host hackers, misinformation, child exploitation material, spam and hate speech. BPH providers like ZSERVERS, protect and enable cyber-criminals, offering a range of purchasable tools which mask their locations, identities, and activities. Targeting these providers can disrupt hundreds or thousands of criminals simultaneously.

The new sanctions are the latest in a series of coordinated steps alongside US and Australian partners, and comes off the back of recent sanctions against notorious ransomware groups LockBit and Evil Corp.

LockBit affiliates are known to have used ZSERVERS as a launch pad for targeting the UK, enabling ransomware attacks against various targets, including the non-profit sector.