Britain's NCA, FBI, Europol disrupt Lockbit cybercrime gang

ronjor · Feb 19, 2024

By James Pearson February 19, 2024

LONDON, Feb 19 (Reuters) - Lockbit, a notorious cybercrime gang that holds its victims' data to ransom, has been disrupted in a rare international law enforcement operation by Britain’s National Crime Agency, the U.S. Federal Bureau of Investigation and Europol, according to a post on the gang’s extortion website on Monday.
Click to expand...

FanJ · Feb 20, 2024

The Guardian
Tue 20 Feb 2024 14.16 CET
Last modified on Tue 20 Feb 2024 17.17 CET
Seized ransomware network LockBit rewired to expose hackers to world
https://www.theguardian.com/technol...-lock-cybercrime-group-out-of-lockbit-website

Disruption to the LockBit operation is significantly greater than first revealed. As well as taking control of the public-facing website, the NCA seized LockBit’s primary administration environment, the infrastructure that allowed it to manage and deploy the technology that it used to extort businesses and individuals around the world.
Click to expand...

==========

Europol
20 Feb 2024
Law enforcement disrupt world’s biggest ransomware operation
https://www.europol.europa.eu/media...t-disrupt-worlds-biggest-ransomware-operation

Decryption tools available on No More Ransom

With Europol’s support, the Japanese Police, the National Crime Agency and the Federal Bureau of Investigation have concentrated their technical expertise to develop decryption tools designed to recover files encrypted by the LockBit Ransomware.

These solutions have been made available for free on the ‘No More Ransom’ portal, available in 37 languages
Click to expand...

No More Ransom:
https://www.nomoreransom.org/en/decryption-tools.html

==========

Dutch Police - in Dutch
20-02-2024
https://www.politie.nl/nieuws/2024/...s-werelds-grootste-ransomware-groepering.html

They say that 13 servers in The Netherlands were taken offline.

==========

FBI
LockBit Victim Reporting Form
https://lockbitvictims.ic3.gov/

Below is a questionnaire for U.S. victims and non-U.S. victims who wish to participate in the U.S. LockBit prosecutions (e.g., to submit a victim-impact statement or to claim restitution), and/or are seeking additional information or help with a LockBit attack against their organization
Click to expand...

Malcontent · Feb 22, 2024

The law enforcement operation to dismantle the LockBit ransomware service has announced shutting more than 14,000 accounts on third-party services used by affiliated criminals.

Accounts on file-hosting service Mega and encrypted email providers Tutanota and Protonmail were used “for exfiltration or infrastructure,” according to a post on LockBit’s seized darkweb domain.[/quote[

LockBit takedown: Police shut more than 14,000 accounts on Mega, Tutanota and Protonmail
Click to expand...

FanJ · Feb 22, 2024

The Register - Thu 22 Feb 2024 // 19:45 UTC
Authorities dismantled LockBit before it could unleash revamped variant
https://www.theregister.com/2024/02/22/lockbit_dismantled_new_variant/

Law enforcement's disruption of the LockBit ransomware crew comes as the criminal group was working on bringing a brand-new variant to market, research reveals.

As part of the daily LockBit leaks this week, Trend Micro's report on the group, published today, analyzed a cross-platform version researchers believe was being designed to succeed the most recent LockBit 3.0 iteration.
Click to expand...

Unlike rivals ALPHV/BlackCat and others in the space, LockBit didn't opt for one of the trendier memory-safe languages like Rust for its latest locker. Instead, it chose .NET for the code and CoreRT for the compiler – a choice Trend Micro says would have allowed it to target more platforms with a single program.
It was also packed using MPRESS – a choice the developers "possibly" made to evade static file detection.
Click to expand...

==========

TrendMicro - February 22, 2024
LockBit Attempts to Stay Afloat With a New Version
https://www.trendmicro.com/en_us/re...tempts-to-stay-afloat-with-a-new-version.html

This research is the result of our collaboration with the National Crime Agency in the United Kingdom, who recently took action against LockBit as part of an international effort resulting in the disruption of the group's infrastructure and undermining of its operations. More details can be found on their website here.
Click to expand...

Long article. Read there more!

ronjor · Feb 23, 2024

Hackers are exploiting ConnectWise flaws to deploy LockBit ransomware, security experts warn

Carly Page@carlypage_ February 23, 2024
Researchers at cybersecurity companies Huntress and Sophos told TechCrunch on Thursday that both had observed LockBit attacks following the exploitation of a set of vulnerabilities impacting ConnectWise ScreenConnect, a widely used remote access tool used by IT technicians to provide remote technical support on customer systems.
Click to expand...

stapp · Feb 26, 2024

LockBit Ransomware Group Resurfaces After Law Enforcement Takedown

The threat actors behind the LockBit ransomware operation have resurfaced on the dark web using new infrastructure, days after an international law enforcement exercise seized control of its servers.
To that end, the notorious group has moved its data leak portal to a new .onion address on the TOR network, listing 12 new victims as of writing.
Click to expand...

https://thehackernews.com/2024/02/lockbit-ransomware-group-resurfaces.html

FanJ · Feb 26, 2024

stapp said: ↑

LockBit Ransomware Group Resurfaces After Law Enforcement Takedown

https://thehackernews.com/2024/02/lockbit-ransomware-group-resurfaces.html
Click to expand...

See also ( but be strongly warned !!! )
h T T p X://samples.vx-underground.org/tmp/Lockbit_Statement_2024-02-24.txt

stapp · Feb 27, 2024

FanJ said: ↑

See also ( but be strongly warned !!! )
h T T p X://samples.vx-underground.org/tmp/Lockbit_Statement_2024-02-24.txt
Click to expand...

Posted in quite a few places now eg.
https://www.theregister.com/2024/02/26/lockbit_back_in_action/

https://samples.vx-underground.org/tmp/Lockbit_Statement_2024-02-24.txt

FanJ · May 7, 2024

LockBit leader unmasked and sanctioned
National Crime Agency - 07 May 2024
https://nationalcrimeagency.gov.uk/news/lockbit-leader-unmasked-and-sanctioned

A leader of what was once the world’s most harmful cyber crime group has been unmasked and sanctioned by the UK, US and Australia, following a National Crime Agency-led international disruption campaign.

The sanctions against Russian national Dmitry Khoroshev (pictured), the administrator and developer of the LockBit ransomware group, are being announced today by the FCDO alongside the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) and the Australian Department of Foreign Affairs.
Click to expand...

Khoroshev, AKA LockBitSupp, who thrived on anonymity and offered a $10 million reward to anyone who could reveal his identity, will now be subject to a series of asset freezes and travel bans.

US partners have also unsealed an indictment against him and are offering a reward of up to $10m for information leading to his arrest and/or conviction.
Click to expand...

The true impact of LockBit’s criminality was previously unknown, but data obtained from their systems showed that between June 2022 and February 2024, more than 7,000 attacks were built using their services. The top five countries hit were the US, UK, France, Germany and China.
Click to expand...

The group has attempted to rebuild over the last two months, however the NCA assesses that as a result of this investigation, they are currently running at limited capacity and the global threat from LockBit has significantly reduced.

LockBit have created a new leak site on which they have inflated apparent activity by publishing victims targeted prior to the NCA taking control of its services in February, as well as taking credit for attacks perpetrated using other ransomware strains.
Click to expand...

Read there more!

FanJ · May 7, 2024

New series of measures issued against the administrator of LockBit
Europol - 07 May 2024
https://www.europol.europa.eu/media-press/newsroom/news/new-measures-issued-against-lockbit

Today, authorities from the United Kingdom, United States and Australia are revealing the second phase of Operation Cronos – the sanctions.
Click to expand...

The administrator and developer of LockBit, a Russian national, is now subject to a series of asset freezes and travel bans issued by the UK Foreign, Commonwealth and Development Office, alongside the US Department of the Treasury’s Office of Foreign Assets Control (OFAC) and the Australian Department of Foreign Affairs and Trade.
Prosecutors in the United States have also unsealed an indictment against him based on his alleged role as the creator, developer, and administrator of the LockBit ransomware variant. Additionally, authorities in the United States are offering a reward of up to USD 10 million for information leading to his arrest and/or conviction.
Click to expand...

Europol disseminates some 3 500 victim intelligence packages
Law enforcement is now in possession of over 2 500 decryption keys and are continuing to contact LockBit victims to offer support.

Europol has been exploiting the vast amount of data gathered during the investigation and the first phase of action to identify these victims, who are located all over the world. Its European Cybercrime Centre (EC3) has disseminated some 3 500 intelligence packages containing information about Lockbit victims to 33 countries.

With Europol’s support, the Japanese Police, the National Crime Agency and the Federal Bureau of Investigation have concentrated their technical expertise to develop decryption tools designed to recover files encrypted by the LockBit ransomware.

These solutions have been made available for free on the No More Ransom portal, available in 37 languages.
Click to expand...

Read there more.

ronjor · May 13, 2024

How Did Authorities Identify the Alleged Lockbit Boss?

May 13, 2024
Last week, the United States joined the U.K. and Australia in sanctioning and charging a Russian man named Dmitry Yuryevich Khoroshev as the leader of the infamous LockBit ransomware group. LockBit’s leader “LockBitSupp” claims the feds named the wrong guy, saying the charges don’t explain how they connected him to Khoroshev. This post examines the activities of Khoroshev’s many alter egos on the cybercrime forums, and tracks the career of a gifted malware author who has written and sold malicious code for the past 14 years.
Click to expand...

stapp · May 8, 2025 at 12:41 AM

LockBit ransomware gang hacked, victim negotiations exposed

The LockBit ransomware gang has suffered a data breach after its dark web affiliate panels were defaced and replaced with a message linking to a MySQL database dump.
All of the ransomware gang's admin panels now state. "Don't do crime CRIME IS BAD xoxo from Prague," with a link to download a "paneldb_dump.zip."
Click to expand...

https://www.bleepingcomputer.com/ne...ware-gang-hacked-victim-negotiations-exposed/

Log in or Sign up

Britain's NCA, FBI, Europol disrupt Lockbit cybercrime gang

ronjor Global Moderator

FanJ Updates Team

Malcontent Registered Member

FanJ Updates Team

ronjor Global Moderator

stapp Global Moderator

FanJ Updates Team

stapp Global Moderator

FanJ Updates Team

FanJ Updates Team

ronjor Global Moderator

stapp Global Moderator

Log in or Sign up

Britain's NCA, FBI, Europol disrupt Lockbit cybercrime gang

ronjor Global Moderator

FanJ Updates Team

Malcontent Registered Member

FanJ Updates Team

ronjor Global Moderator

stapp Global Moderator

FanJ Updates Team

stapp Global Moderator

FanJ Updates Team

FanJ Updates Team

ronjor Global Moderator

stapp Global Moderator

Useful Searches