Dutch police and the Public Prosecution Service have taken down a network of 127 command-and-control servers.
This network was operated by ZServers/XHost, a so-called bulletproof hosting provider offering cybercriminals a safe haven to facilitate illegal activities, such as spreading malware and carrying out cyberattacks.
A bulletproof hoster is a hosting company that protects criminals by renting out servers with guarantees of anonymity and safeguards against law enforcement.
Such services are a critical infrastructure for cybercriminals, allowing them to host hacking tools, ransomware, botnets, and other malicious software.
Think of it as a secret hideout for stolen goods, where the owner denies any knowledge of illegal activities.
Online, a bulletproof hoster provides the same kind of safe haven, but with a much larger global impact.
The investigation into ZServers/XHost began a year ago after the company advertised services that explicitly facilitated criminal activities.
Customers could access fully anonymous hosting options and make payments via cryptocurrency with the promise that no information would be shared with authorities. This raised red flags with the Cybercrime Team Amsterdam.
During the raid, investigators uncovered hacking tools from infamous ransomware groups like Conti and Lockbit, which have caused significant damage worldwide. Although no arrests have been made yet, further analysis of the seized data is ongoing.
Without bulletproof hosters, much of global cybercrime would not be possible. These companies provide criminals with an uninterrupted platform to manage hacking tools, stolen data, and phishing websites.
The Netherlands, with its advanced digital infrastructure, is often exploited for such activities, highlighting the urgent need for stricter regulations, such as a know-your-customer (KYC) policy.
The dismantling of this network marks a major victory in the fight against cybercrime. By taking down one of the shadowy hubs of the digital underworld, Dutch authorities have sent a strong message.
However, the need for international cooperation and stricter legislation remains critical to combat this complex and borderless threat effectively.
Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free
In a disturbing trend, cybercriminals, predominantly from Chinese underground networks, are exploiting Near Field Communication…
In a concerning trend for cybersecurity, multiple threat actors, including ransomware groups and state-sponsored entities,…
Unit 42’s 2025 Global Incident Response Report, ransomware actors are intensifying their cyberattacks, with 86%…
Group-IB’s High-Tech Crime Trends Report 2025 reveals a sharp 22% surge in phishing websites, with…
Cybersecurity firm Volexity has tracked a series of highly targeted attacks by suspected Russian threat…
Threat actors are increasingly leveraging Google Forms, the tech giant’s widely-used form and quiz-building tool,…
.jpeg?w=1024&resize=1024,682&ssl=1)
