Last week, the United States, Australia, and the United Kingdom imposed sanctions against Zservers and a related British company, XHOST Internet Solutions LP. According to the U.S. Department of the Treasury, Zservers provided infrastructure for ransomware attacks organized by the LockBit cybercriminal group and assisted hackers in illicit money laundering.
According to the Dutch National Police, the hosting services provider was also involved with unnamed botnets and malware distribution. Politie claims that Zservers knowingly facilitated this malicious activity, and its ads implied that Zservers infrastructure could be used for criminal activity.
The servers were seized from a data center located at Paul van Vlissingenstraat street in Amsterdam. Politie emphasizes that cybercriminals could purchase company’s services anonymously by paying for them with cryptocurrency. Currently, all sites hosted on the seized servers are unavailable.
According to the law enforcement authorities, one of the seized servers contains hacking tools belonging to two well-known ransomware groups: LockBit and Conti.
All the 127 servers will examined by cyber forensics experts in Amsterdam. New evidence is expected to be retrieved, as well as information pertaining to other hackers’ operations.
