Lockbit Gang Dismantled in International Police Operation
Interpol and the British National Crime Agency (NCA) have successfully penetrated Lockbit's systems and exfiltrated its data. As a notable ransomware group believed to operate from Russia, Lockbit is a major player in the cybercriminal landscape, providing services to other criminal entities.
On Monday, Lockbit's website displayed a message indicating it was "now under control of law enforcement." This operation is deemed a significant disruption in the cybercriminal world, marking the first of its kind led by the UK, with collaboration from the FBI, Europol, and other countries.
Who is the Lockbit Ransomware Gang?
Lockbit is commonly employed by criminals to infiltrate computers of companies and organizations, encrypt user data, and demand a ransom for its release. The group, which emerged in 2019, holds a substantial market share in ransomware, estimated at 20-25%.
Lockbit has targeted high-profile entities, including Royal Mail, ICBC, suppliers to the NHS, law firm Allen & Overy, and Boeing. The NCA's covert operation gathered data on Lockbit's activities, leading to the seizure of the dark web site where the group operated.
Law enforcement took control of the dark web site, replacing it with emblems of various agencies and a message indicating NCA's control, in collaboration with the FBI and 'Operation Cronos,' an international law enforcement task force.
At a subsequent press conference, the head of the NCA, Graeme Biggar, stated that Lockbit was responsible for 25% of ransomware attacks in the past year, resulting in losses totaling billions. Thousands of victims globally, including 200 in the UK, were identified, with the acknowledgment that actual numbers might be higher.
Criminal Affiliates Cut Off from Lockbit Infrastructure
Lockbit operates as a one-stop-shop for criminal services, with affiliates paying for hacking operations, malicious software, and guidance. Following law enforcement's action, affiliates attempting to access the site were met with a message revealing that Lockbit's internal data, including victim details and extortion amounts, was in the hands of law enforcement. The intention is to disrupt the group's credibility and reputation, creating distrust among affiliates and discouraging future collaboration with Lockbit due to the perceived risk of law enforcement surveillance.
