Dutch National Police Seize and Shut Down 127 Servers Linked to Zservers/XHostThe Dutch National Police have announced that their specialists have seized and deactivated 127 servers located in a data center on Paul van Vlissingenstraat in Amsterdam. These servers belonged to Russian internet hosting provider Zservers and British company XHost Internet Solutions LP.
According to law enforcement, the hosting providers were allegedly involved in operating undisclosed botnets and distributing malicious software. Investigators discovered that cybercriminals could anonymously purchase services from these companies, often paying with cryptocurrency. As a result of the operation, all websites hosted on these servers are now inaccessible. Authorities also revealed that one of the confiscated servers contained hacking tools used by the notorious ransomware groups LockBit and Conti.
Previously, the U.S. Department of the Treasury, along with regulators from the UK and Australia, imposed full blocking sanctions on Zservers and two individuals believed to be its administrators. These sanctions were enacted due to the hosting provider’s alleged involvement in supporting LockBit ransomware attacks, including those targeting the UK postal service.
As part of the restrictions, all assets belonging to Zservers and associated individuals within U.S. jurisdiction have been frozen. The company’s leadership is banned from entering the United States, and U.S. businesses and individuals are prohibited from engaging in any transactions with the organization. Additionally, Zservers will no longer be able to acquire advanced U.S. technologies without a license, which authorities are expected to deny in most cases.
The U.S. Treasury explained that the sanctioned entities “facilitated ransomware attacks and other criminal activities.” Officials believe they played a role in enabling cyber extortion operations involving LockBit, while Zservers allegedly provided bulletproof hosting services (BPH). The two Russian individuals sanctioned by the U.S. as part of this measure are Alexander Mishin and Alexander Bolshakov.
The UK regulator has also added Zservers, Mishin, and Bolshakov to its sanctions list, alongside XHost, which it considers owned or controlled by Zservers. Additionally, individuals Ilya Sidorov, Igor Odintsov, Dmitry Bolshakov, and Vladimir Ananyev have been sanctioned for their alleged involvement with Zservers. As a result, all their assets have been frozen, and they are now barred from entering the United Kingdom.