US, UK, and Australia Target Russia-Based Zservers Over Lockbit Ransomware Attacks

The United States, joined by the United Kingdom and Australia, has taken coordinated action against Zservers, a Russia-based service provider linked to supporting the notorious Lockbit ransomware attacks. The U.S. Department of Treasury announced the sanctions on Tuesday, highlighting national security concerns related to ransomware operations.

Designations and Actions:

The U.S. Treasury’s Office of Foreign Assets Control (OFAC) added two Russian nationals to its sanctions list, accusing them of being key administrators for Zservers, a company that provides bulletproof hosting services (BPH) commonly used by cybercriminals. These services enable cyber actors, including ransomware groups, to carry out attacks on critical infrastructure both in the U.S. and internationally.

Bradley Smith, acting Under Secretary of the Treasury for Terrorism and Financial Intelligence, emphasized that third-party providers like Zservers play a crucial role in facilitating the operations of cybercriminals, including those behind Lockbit attacks.

Broader Context:

This move is part of a broader effort to combat cybercrime, following similar actions last year that saw joint sanctions from the U.S., UK, and Australia against the Evil Corp ransomware group. The sanctions are aimed at disrupting the infrastructure that supports cybercriminal activities globally.