LockBit 4.0 Ransomware Resurfaces
LockBit 4.0 is a fresh iteration of the LockBit ransomware, unveiled in February 2024. Coincidentally, this release aligns with the arrest of two LockBit operators by law enforcement agencies during the same month. Merely five days subsequent to this incident, the threat actors issued a statement declaring a restructuring effort and expressing their intention to persist under the same name.
Functioning with the primary purpose of encrypting data and demanding ransoms for decryption, LockBit 4.0 showcased its capabilities on our test machine. The ransomware sample encrypted files and appended a ".xa1Xx3AXs" extension to their original filenames. For instance, a file initially denoted as "1.jpg" transformed into "1.jpg.xa1Xx3AXs," and "2.png" became "2.png.xa1Xx3AXs." Concurrently, the ransomware generated a ransom note named "xa1Xx3AXs.README.txt."
The ransom note communicates to the victim that their company has fallen prey to an attack. The malware has not only encrypted files but also exfiltrated sensitive data. The victim is then instructed to remit a ransom of 1000 USD in Bitcoin cryptocurrency. Assurance is provided that upon receipt of the payment, the attackers will dispatch the decryption tools and erase the pilfered content. Non-compliance with the ransom demand is warned to result in repeated targeting of the company. Moreover, the victim is cautioned against making alterations or deletions to the affected files, as such actions may lead to irreversible data loss.
LockBit 4.0 Ransom Note in Full
The complete text of the ransom note used by LockBit 4.0 goes as follows:
LockBit 4.0 Ransomware since 2024
Your data are stolen and encrypted
Price = 1000 $
Bitcoin = 328N9mKT6xFe6uTvtpxeKSymgWCbbTGbK2
Email = jimyjoy139@proton.meWhat guarantees that we will not deceive you?
We are not a politically motivated group and we do not need anything other than your money.
If you pay, we will provide you the programs for decryption and we will delete your data.
Life is too short to be sad. Be not sad, money, it is only paper.If we do not give you decrypters, or we do not delete your data after payment, then nobody will pay us in the future.
Therefore to us our reputation is very important. We attack the companies worldwide and there is no dissatisfied victim after payment.Your personal DECRYPTION ID: -
Warning! Do not DELETE or MODIFY any files, it can lead to recovery problems!
Warning! If you do not pay the ransom we will attack your company repeatedly again!
How Can You Safeguard Your Valuable Data Against Ransomware?
Safeguarding your valuable data against ransomware requires a proactive and multi-layered approach to enhance overall cybersecurity. Here are some key strategies to protect your data:
Regular Backups:
Schedule regular backups of your critical data to an external, offline, or cloud storage system.
Ensure backups are automated, and verify their integrity periodically.
In the event of a ransomware attack, having recent backups allows you to restore your data without paying the ransom.
Keep Software and Systems Updated:
Regularly update operating systems, software, and applications to patch known vulnerabilities.
Enable automatic updates whenever possible to ensure timely protection against emerging threats.
Use Robust Antivirus and Anti-Malware Software:
Install reputable antivirus and anti-malware solutions on all devices.
Keep the security software up-to-date and perform regular scans to detect and remove potential threats.
Employee Training and Awareness:
Educate employees on the dangers of phishing emails and social engineering tactics often used to spread ransomware.
Conduct regular training sessions to enhance cybersecurity awareness and emphasize the importance of safe online practices.
Network Segmentation:
Implement network segmentation to isolate critical systems and limit the lateral movement of ransomware within your network.
Restrict user access based on the principle of least privilege to minimize potential damage.
Email Security:
Employ email filtering solutions to identify and block malicious attachments or links.
Encourage users to verify the authenticity of unexpected emails, especially those requesting sensitive information.
Endpoint Protection:
Utilize endpoint protection tools that offer real-time monitoring and behavioral analysis to identify and block ransomware activity.
