New UK sanctions target Russian cybercrime network
A key Russian cybercrime syndicate responsible for aiding merciless ransomware attacks around the world has been targeted by new UK sanctions.

- UK sanctions target Russian cyber entity, ZSERVERS responsible for facilitating crippling ransomware attacks globally
- targets also include 6 ZSERVERS members who are part of a prolific cybercrime supply chain, and their UK front company XHOST
- action on illicit Russian cybercrime syndicate is latest step to strengthen UK national security
Fresh sanctions are targeting ZSERVERS, a听key component听of the Russian cybercrime supply chain, and 6 of its members, as well as its UK front company, XHOST Internet Solutions LP. ZSERVERS provide vital infrastructure for cybercriminals as they plan and execute attacks against the UK.听听听听
The illicit supply chain protects, supports and conceals the operations of some of the world鈥檚 most ruthless ransomware gangs. Ransomware actors rely on these services to launch attacks, extort victims and store stolen data.听听听
In the modern digital-first economy, cyber security is a non-negotiable cornerstone of business success. A secure digital economy is a less听attractive target for cybercriminals and a more attractive home for investment, generating jobs and putting more money into hardworking people鈥檚 pockets, delivering on this government鈥檚 Plan for Change.听
Foreign Secretary, David Lammy, said:
Putin has built a corrupt mafia state鈥痙riven by greed and ruthlessness. It is no surprise that the most unscrupulous extortionists and cyber-criminals run rampant from within his borders.听听
This government will continue to work with partners to constrain the Kremlin and the impact of Russia鈥檚 lawless cyber underworld. We must counter their actions at every opportunity to safeguard the UK鈥檚 national security and deliver on our Plan for Change.听
Predatory ransomware groups pose a clear and persistent听threat to national security, public services and privacy. These attacks threaten critical national infrastructure, disrupt essential services, compromise sensitive data and generated $1 billion from their victims globally in 2023 alone.听听
Minister of State for Security, Dan Jarvis, said:
Ransomware attacks by Russian affiliated cybercrime gangs are some of the most harmful cyber threats we face today and the government is tackling them head on. Denying cybercriminals the tools of their trade weakens their capacity to do serious harm to the UK.听听
We have already announced new world-first proposals to deter ransomware attacks and destroy their business model. 听With these targeted sanctions and the full weight of our law enforcement, we are countering the threats we face to protect our national security, a foundation of our Plan for Change, and our economy.
ZSERVERS explicitly advertise themselves to illicit actors as a Bulletproof Hosting (BPH) Provider. Some BPH are known to host hackers, misinformation, child exploitation material,鈥痵pam and hate speech. BPH providers like ZSERVERS, protect and enable cybercriminals, offering a range of purchasable tools which mask their locations, identities, and activities. Targeting these providers can disrupt hundreds or thousands of criminals simultaneously.听听
Today鈥檚 action is the latest in a series of coordinated steps alongside US and Australian partners, and comes听off the back听of recent sanctions against notorious ransomware groups LockBit and Evil Corp.听听
LockBit affiliates are known to have used ZSERVERS as a launch pad for targeting the UK, enabling ransomware attacks against various targets, including the non-profit sector.听听听
Protecting the nation from threats both physical and digital sits at the foundation of the government鈥檚 Plan for Change. That is why we are moving through the entire ransomware pipeline step by step, cracking down on Russian cybercriminals that threaten the UK鈥檚 security, integrity, and prosperity.
叠补肠办驳谤辞耻苍诲听
The full list of those sanctioned today:听听
- 窜厂贰搁痴贰搁厂听听
- XHOST Internet Solutions LP 听听
- Aleksandr Bolshakov (employee)听听
- Aleksandr Mishin (employee)听听
- Ilya Sidorov (employee)听听
- Dmitriy Bolshakov (employee)听听
- Igor Odintsov (employee)听听
- Vladimir Ananev (employee)
Further information on how our actions align with the UK government鈥檚 overall strategy to disrupt cybercrime, and how these actors support the broader cybercrime ecosystem: 听
An overview of Bulletproof Hosting (BPH) providers from our Australian partners:
View the full UK Sanctions List and more information on UK sanctions relating to Russia.
Media enquiries
Email newsdesk@fcdo.gov.uk
Telephone 020 7008 3100
Email the FCDO Newsdesk (monitored 24 hours a day) in the first instance, and we will respond as soon as possible.