LockBit | Business Upturn

Lockbit claims resurgence after global police takedown

Eesha Chakraborty — Tue, 27 Feb 2024 03:17:29 +0000

In a surprising turn of events, the notorious cybercrime group Lockbit, known for its use of ransomware to extort victims, claims to be operational again following a recent international takedown effort by law enforcement agencies.

Earlier in February, a coordinated operation led by the United Kingdom’s National Crime Agency (NCA) targeted Lockbit. This unprecedented effort resulted in arrests, indictments, and the seizure of the group’s infrastructure, effectively taking them offline.

However, in a recent statement, Lockbit asserts that they have restored their servers and are back in business. They claim their “backup blogs,” which are believed to be alternative platforms for leaking stolen data from victims, were unaffected by the takedown due to their use of a different programming language. This statement, posted on a newly established dark website, further asserts that stolen data leaks will continue.

The NCA, however, disputes Lockbit’s claims. They maintain that the group remains “completely compromised” and emphasize their ongoing efforts to disrupt Lockbit’s activities. Additionally, they acknowledge the possibility of the group attempting to rebuild and regroup, highlighting the vast amount of intelligence gathered about Lockbit and its associates.

While the group claims partial functionality, the effectiveness of the police operation and the extent of Lockbit’s capabilities are still under investigation. Cybersecurity experts continue to advise organizations to remain vigilant and implement robust defenses against the ever-present threat of ransomware attacks.

International law enforcement dismantles LockBit ransomware gang

Eesha Chakraborty — Tue, 20 Feb 2024 17:29:46 +0000

In a significant blow to the global cybercrime landscape, a coalition of international law enforcement agencies, led by the FBI and the UK National Crime Agency, has successfully disrupted the operations of the notorious LockBit ransomware gang. This coordinated effort, involving authorities from 11 countries, dealt a crippling strike to LockBit’s infrastructure, seizing control of its website and shutting down 11,000 domains used by the group and its affiliates to facilitate their ransomware attacks.

LockBit, notorious for its brutal tactics and high-profile targets, has plagued the digital landscape for several years. Their modus operandi involves deploying ransomware, a type of malicious software that encrypts victims’ data, rendering it inaccessible. They then demand exorbitant sums of money in exchange for decryption keys, inflicting significant financial losses and operational disruptions on businesses and organizations.

The operation targeted the core infrastructure of LockBit, seizing control of over 11,000 domains used by the group and its affiliates for facilitating ransomware activities. This included taking down the LockBit website, and effectively severing their primary communication channel with potential victims and collaborators. Additionally, law enforcement officials disrupted LockBit’s malware deployment system, further hindering their capacity to launch new attacks.

Notably, LockBit was behind the 2023 attack on the U.S. arm of the Industrial & Commercial Bank of China, causing significant disruption to the U.S. Treasury market, and also compromised a website used by Boeing to sell spare parts and services.

The group’s operations are estimated to have netted millions in ransom payments, with the FBI reporting over 144 million dollars extorted from victims in the United States alone. LockBit’s reach extended beyond national borders, claiming over 3,600 victims globally, primarily from the private sector.

The successful disruption of LockBit marks a significant victory in the ongoing fight against cybercrime. It demonstrates the power of international cooperation and coordinated action in tackling sophisticated cyber threats. Furthermore, the action encourages victims of cyberattacks to come forward and report them to law enforcement authorities.

UK and U.S. collaborate to target LockBit cybercrime syndicate

Jennifer Philip — Tue, 20 Feb 2024 14:53:24 +0000

A coordinated law enforcement effort led by the UK’s National Crime Agency (NCA) has successfully seized the “command and control” infrastructure of the LockBit ransomware group. This operation involved collaboration between the NCA, the FBI, Europol, and various international police agencies. LockBit’s website now displays a message indicating its takeover by the NCA, FBI, and Operation Cronos, an international law enforcement task force.

As a result of this operation, two individuals associated with LockBit have been apprehended in Poland and Ukraine, while two others, believed to be affiliates, have been arrested and charged in the US. However, two additional suspects, identified as Russian nationals, remain at large. Furthermore, authorities have taken action by freezing over 200 cryptocurrency accounts linked to the criminal organization.

The NCA disclosed that the extent of the disruption to the LockBit operation exceeds initial reports. In addition to gaining control of the public-facing website, the agency seized LockBit’s primary administration environment, the infrastructure used to manage and deploy the hacking technology for extorting businesses and individuals globally.

Graeme Biggar, the NCA’s director general, stated, “Through our close collaboration, we’ve infiltrated the hackers’ systems, seized their source code, and acquired keys to assist victims in decrypting their systems. LockBit has effectively been shut down. We’ve significantly weakened the group’s capability and credibility, which relied on secrecy and anonymity.”

LockBit is known for pioneering the “ransomware as a service” model, outsourcing target selection and attacks to semi-independent “affiliates” while taking a commission on ransoms.
Apart from encrypting data and demanding payment for decryption keys, LockBit also threatened to publish stolen data if ransoms were not paid, falsely promising to delete copies upon receipt of payment. However, the NCA discovered that some victims’ data remained on LockBit’s systems even after ransom payments were made.

Home Secretary James Cleverly commented, “The NCA’s exceptional expertise has dealt a significant blow to the individuals behind one of the most widespread ransomware strains worldwide.”
In a recent blog post, Ciaran Martin, the former head of the National Cybersecurity Centre, emphasized that the presence of Russian hackers in cybercrime undermines conventional law enforcement strategies. He advised taking action to disrupt cyber criminals whenever possible but cautioned that this approach is not a long-term solution as long as Russia continues to provide a haven for them.