The UK government has sanctioned Russian entity Zservers, as well as six individual members of the cyber group and its UK representative, XHOST.
In a Foreign, Commonwealth and Development Office statement under the names of foreign secretary David Lammy and minster of state for security Dan Jarvis, the government said Zservers provides vital infrastructure for cyber criminals as they plan and execute attacks against the UK.
The government characterises it as a component in a supply chain that supports and conceals the operations of ransomware gangs. Ransomware exponents rely on these services, it is said, to launch attacks, extort victims and store stolen data.
“Putin has built a corrupt mafia state driven by greed and ruthlessness,” said Lammy. “It is no surprise that the most unscrupulous extortionists and cyber criminals run rampant from within his borders.
“This government will continue to work with partners to constrain the Kremlin and the impact of Russia’s lawless cyber underworld,” he said. “We must counter their actions at every opportunity to safeguard the UK’s national security and deliver on our plan for change.”
The plan for change involves building 1.5 million homes in England, fast-tracking planning decisions on 150-plus “major economic infrastructure projects”, as well as attaining an NHS standard of 92% of patients in England waiting no longer than 18 weeks for elective treatment.
As for Zservers, the government said the group advertises itself as a “bulletproof hosting (BPH) provider”.
BPH providers like Zservers, said the government, “protect and enable cyber criminals, offering a range of purchasable tools which mask their locations, identities and activities. Targeting these providers can disrupt hundreds or thousands of criminals simultaneously.
The UK is working alongside the US and Australia in this effort. The government cited sanctions against ransomware groups LockBit and Evil Corp as part of an ongoing campaign, which includes the National Crime Agency (NCA)’s identification of a prominent member of the Evil Corp cyber crime collective who also worked as an affiliate of the LockBit ransomware gang, Aleksandr Ryzhenkov.
LockBit affiliates are known, said the government, to have used Zservers as a launch pad for targeting the UK, enabling ransomware attacks against various targets, including the non-profit sector.
“Ransomware attacks by Russian affiliated cyber crime gangs are some of the most harmful cyber threats we face today, and the government is tackling them head on,” said Jarvis. “Denying cyber criminals the tools of their trade weakens their capacity to do serious harm to the UK.
“We have already announced new world-first proposals to deter ransomware attacks and destroy their business model. With these targeted sanctions and the full weight of our law enforcement, we are countering the threats we face to protect our national security.”
List of sanctions
The list of those sanctioned is: Zservers, XHOST Internet Solutions LP, Aleksandr Bolshakov (employee), Aleksandr Mishin (employee), Ilya Sidorov (employee), Dmitriy Bolshakov (employee), Igor Odintsov (employee) and Vladimir Ananev (employee).
Since Russia’s attack on Ukraine was launched three years ago, western countries have applied economic sanctions against Russia and Russian individuals, with limited impact, including the unintended consequence of enabling Chinese spies to penetrate Russian defence research institutes, dubbed Twisted Panda.
The Economist published a podcast in 2024 evidencing a consensus that the Russian economy has proved “shockingly resilient” to western sanctions, thanks largely to non-Nato countries giving succour to Russia. Historically, only the prevention of the so-called “war of the stray dog” between Greece and Bulgaria in 1925 can be chalked up to sanctions, even if they have some limited value.
Meanwhile, the Google Threat Intelligence Group has recently published a report detailing a systematic and growing convergence of cyber criminality with cyber warfare, mainly based in Russia and China.
