WASHINGTON — The U.S., U.K. and Australia on Tuesday sanctioned a Russian web-hosting services provider and two Russian men who administer the service in support of Russian ransomware syndicate LockBit.
The Treasury Department’s Office of Foreign Assets Control and its U.K. and Australian counterparts sanctioned Zservers, a Russia-based bulletproof hosting services provider — which is a web-hosting service that ignores or evades law enforcement requests — and two Russian nationals serving as Zservers operators.
Treasury alleges that Zservers provided LockBit access to specialized servers designed to resist law enforcement actions.
LockBit ransomware attacks have extracted more than $120 million from thousands of victims around the world. LockBit has operated since 2019, and is the most deployed ransomware variant across the world and continues to be prolific, according to the U.S. Cybersecurity and Infrastructure Security Agency.
The Treasury Department’s Acting Under Secretary for Terrorism and Financial Intelligence, Bradley T. Smith, said Tuesday’s action “underscores our collective resolve to disrupt all aspects of this criminal ecosystem, wherever located, to protect our national security.”
LockBit has been linked to attacks on airplane manufacturer Boeing, the November 2023 attack against the Industrial Commercial Bank of China, the U.K.’s Royal Mail, Britain’s National Health Service and international law firm Allen and Overy.
Ransomware is the costliest and most disruptive form of cybercrime, crippling local governments, court systems, hospitals and schools as well as businesses. It is difficult to combat as most gangs are based in former Soviet states and out of reach of Western justice.
Tammy Bruce, a State Department spokeswoman said Tuesday’s sanctions “underscore the United States’ commitment, along with our international partners, to combating cybercrime and degrading the networks that enable cyber criminals to target our citizens.”
___
Associated Press reporter Matt Lee contributed to this story.