LockBit Cybercrime Rsnsomewear Taken Over by International Law Enforcement

[GordMay]

LockBit [1], a notorious cybercrime gang, that holds its victims' data to ransom, has been disrupted, in a rare international law enforcement operation [“Operation Cronos”], by Britain's National Crime Agency, the U.S. Federal Bureau of Investigation, Europol, and other international police organizations, from France, Japan, Switzerland, Canada, Australia, New Zealand, Sweden, the Netherlands, Finland and Germany., according to a post on the gang's extortion website, on Monday.

LockBit [1] has hit more than 1,700 organizations, in nearly every industry, from financial services, and food, to schools, transportation, and government departments, in the United States. Those attacks collectively cost those organizations about $91 million US, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) said, last year. [2]

FBI and allies seize dark-web site of world’s most prolific ransomware gang
➥ https://www.cnn.com/2024/02/19/polit...ite/index.html

”The FBI and its international allies have seized a dark-web site that the world’s most prolific ransomware gang has used to extort its victims, according to a message on the website viewed by CNN.

It’s a blow to the near-term operations of a multinational ransomware gang known as LockBit, which has been a menace to organizations all over the world, including health care providers in the US...

... “We can confirm that Lockbit’s services have been disrupted as a result of International Law Enforcement action — this is an ongoing and developing operation,” says a message posted on the hackers’ website on Monday, along with the seals of the FBI, UK National Crime Agency (NCA) and a host of other law enforcement agencies from Australia to Germany.

An NCA spokesperson confirmed to CNN that a law enforcement operation against LockBit was underway, adding that the agency will publicly disclose more details on Tuesday.

An FBI spokesperson told CNN: “There will be a formal announcement and additional details to follow.” ...”

[1] LockBit
➥ https://www.trendmicro.com/vinfo/us/...tlight-lockbit

[2] “Understanding Ransomware Threat Actors: LockBit” ~ CISA June 24, 2023
➥ https://www.cisa.gov/news-events/cyb...ries/aa23-165a

[ferdinand191]

I really hope that's the end of them. But not sure they will cease to exist.

[BlueH2Obound]

Unless the individuals who ran the website are incarcerated, they didn't stop anything, they just inconvenienced them until they can get back up and running again. There's too much money in it to stop them just by shutting down their present site. A step in the right direction for sure, but not an up panacea.

[GordMay]

Originally Posted by BlueH2Obound

Unless the individuals who ran the website are incarcerated, they didn't stop anything, they just inconvenienced them until they can get back up and running again. There's too much money in it to stop them just by shutting down their present site. A step in the right direction for sure, but not an up panacea.

International Law Enforcement have, already, done much more than inconvenience them.

U.S. Indictment Charges Two Russian Nationals [Artur Sungatov and Ivan Kondratyev AKA ‘Bassterlord’] with Attacks Against Multiple U.S. and International Victims; FBI Seizes Infrastructure; and Department of Treasury Takes Additional Action Against LockBit ...
... we have also obtained keys from the seized LockBit infrastructure to help victims decrypt their captured systems and regain access to their data ...
Much more ➥ https://www.justice.gov/opa/pr/us-an...omware-variant

[wholybee]

Interesting that this months old thread was revived by an account with only one post, exactly today:

https://securityaffairs.com/164873/c...l-reserve.html

https://www.itpro.com/security/ranso...-pinch-of-salt

[GordMay]

Originally Posted by FBI

“ ... With the indictment unsealed today, a total of five LockBit members have now been charged for their participation in the LockBit conspiracy...
... victims of LockBit should contact the FBI at https://lockbitvictims.ic3.gov for further information. Additional details on protecting networks against LockBit ransomware are available at StopRansomware.gov. These include Cybersecurity and Infrastructure Security Agency Advisories AA23-325A, AA23-165A, and AA23-075A...”

At least two [Mikhail Pavlocich Matveev & Ruslan Magomedovich] are presently in custody

Previously linked ➥ https://www.justice.gov/opa/pr/us-an...omware-variant

Watch the Attorney General’s remarks ➥ https://youtu.be/-jKykhKKMZw

[wholybee]

Yes, but those are news reports from February. Yesterday, Lockbit claimed to hack the US Federal Reserve. I don't think they did, but I think they are trying to regain some credibility as a hacking organization by spreading misinformation, and generally bringing attention to themselves in forums etc.

I find it interesting that a new user signed up and posted his first post to this thread today, with Lockbit doing all that that right now. He has made several other relevant sailing posts since then. I haven't made a judgement if his first post was a coincidence, or something else. But it is interesting the timing.

[Kelkara]

Originally Posted by wholybee

Yes, but those are news reports from February. Yesterday, Lockbit claimed to hack the US Federal Reserve. I don't think they did, but I think they are trying to regain some credibility as a hacking organization by spreading misinformation, and generally bringing attention to themselves in forums etc.

I find it interesting that a new user signed up and posted his first post to this thread today, with Lockbit doing all that that right now. He has made several other relevant sailing posts since then. I haven't made a judgement if his first post was a coincidence, or something else. But it is interesting the timing.

I looked at one of his other posts ... If I've read it correctly he's recommending either anchoring in Plymouth UK, or a marina in Plymouth MA as possible alternatives ... it all reads like AI ... my vote is a bot.

[wholybee]

Originally Posted by Kelkara

I looked at one of his other posts ... If I've read it correctly he's recommending either anchoring in Plymouth UK, or a marina in Plymouth MA as possible alternatives ... it all reads like AI ... my vote is a bot.

Nice catch. All of his posts are generic enough to easily be AI responses.

[Henr1y]

I'm not sure that's going to stop them. These hackers know what they're doing. I think we should be prepared against this kind of ransomware. Some tips are mentioned here: https://www.salvagedata.com/lockbit3-ransomware/
Don't know how much they help, but it's still better than nothing.

[CaptTom]

The timing might be a coincidence. Bots will look for old threads to which they can add some useless drivel to gain credibility at the site, before posting whatever spam they were created to spew. It's an interesting topic, so a good target. And it worked. It got us all talking about the subject again. Gotta give them some credit. Frustrating to us humans, but I guess it's something we just have to get used to.