Loading threat actor…
ZServers is a bulletproof hosting provider associated with enabling cybercriminal operations by supplying resilient infrastructure designed to resist abuse complaints, law-enforcement disruption, and takedown efforts. It has been linked to ransomware ecosystem support, including use by LockBit affiliates, and has been identified as part of the infrastructure layer that facilitates malicious activity rather than as a malware operator itself. Its services fit the bulletproof hosting model of deliberately tolerating or facilitating harmful operations such as ransomware support, anonymized hosting, and evasion of intervention by authorities and service providers. ZServers has been the subject of repeated law-enforcement attention and was designated by OFAC in February 2025 for activities similar to other sanctioned bulletproof hosting providers. The available information supports characterization of ZServers as a cybercrime-enabling infrastructure provider with ties to ransomware operations, particularly those involving leak-site and hosting support for affiliates.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
ZServers is a bulletproof hosting provider designated for enabling cybercriminal activities, similar to Media Land and AEZA Group, by providing resilient infrastructure for malicious operations.
Zservers is a bulletproof hosting provider used by Lockbit affiliates for ransomware-as-a-service operations. Authorities from multiple countries have attempted to take down its operations.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.