Dutch National Police Successfully Seized 127 Malicious ZServers/XHost Hosting

Dutch National Police (Politie) have successfully dismantled the ZServers/XHost bulletproof hosting operation, taking offline a staggering 127 servers. This decisive action follows coordinated international sanctions announced earlier this week by authorities in the United States, Australia, and the United Kingdom against the same illicit platform.

ZServers/XHost, operated by Russian nationals Alexander Igorevich Mishin and Aleksandr Sergeyevich Bolshakov, had become a notorious haven for cybercriminals. The platform allegedly provided infrastructure and services that knowingly facilitated a wide range of malicious activities, including:

• LockBit and Conti Ransomware Attacks: ZServers is accused of providing critical hosting infrastructure for some of the most damaging ransomware-as-a-service (RaaS) operations, including LockBit and Conti. These groups have been responsible for countless cyberattacks causing significant financial and operational disruption globally.
• Money Laundering: Beyond hosting malicious software, ZServers is implicated in supporting the laundering of illegally obtained cryptocurrency, further enabling the financial gains of cybercrime.
• Botnet Operations and Malware Distribution: The platform's infrastructure was also leveraged to support botnet command and control, and the widespread distribution of various forms of malware, amplifying the scale and impact of cyber threats.

According to the Politie's official announcement, ZServers openly advertised its "bulletproof" nature, explicitly marketing its lax policies and tolerance for criminal activities to attract malicious actors. This brazen approach solidified its role as a critical component within the global cybercrime ecosystem.

"A bulletproof hoster is not just any shadowy company that ignores rules – it is the backbone of global cybercrime," stated the Dutch Police. "Without these 'safe havens', many criminals would have nowhere to host their hacking tools, stolen data and fake websites."

Technical Details of the Takedown

The 127 seized servers were physically located in the Paul van Vlissingenstraat colocation data centre in Amsterdam. This data center served as the operational heart of ZServers, providing the necessary infrastructure for its illicit activities. Cybercriminals utilizing ZServers could purchase hosting services with complete anonymity, leveraging cryptocurrency for payments, further obscuring their identities and financial transactions.

Currently, all websites and services hosted on the seized servers are offline, effectively disrupting the cybercriminal operations reliant on ZServers' infrastructure.

Cybercrime specialists from the Amsterdam Cybercrime Team are now undertaking a thorough investigation of all 127 seized servers. This forensic analysis is expected to uncover further incriminating evidence, potentially revealing additional cybercriminal operations and identifying individuals involved in these illicit activities.

While this initial action focused on seizing infrastructure, no arrests have been made at this time. However, Mishin and Bolshakov, identified as the administrators of ZServers, have been sanctioned with asset freezes and travel bans, signaling ongoing legal and law enforcement pressure.

The dismantling of ZServers/XHost represents a major victory in the ongoing fight against cybercrime. By removing a key "bulletproof" hosting provider, law enforcement agencies have significantly disrupted the infrastructure relied upon by ransomware groups, botnet operators, and other malicious actors. This operation underscores the increasing international cooperation and technical capabilities being deployed to combat the evolving threat landscape of cybercrime.