LockBit Resurrection

An international coalition of police agencies, including the US Federal Bureau of Investigation and the British National Crime Agency, have resurrected the Dark Web site of the notorious LockBit ransomware gang, which they disrupted and took offline earlier this year.  

In a related development the alleged leader of what was once the world’s largest ransomware outfit, LockBit, has been named as Russian national Dmitry Khoroshev by the UK’s National Crime Agency (NCA).

What was once LockBit’s official Dark Net site reappeared online with new posts that suggest the authorities are planning to soon release new information about the hackers. The posts have titles such as “Who is LockBitSupp?” “What have we learnt,” “More LB hackers exposed,” and “What have we been doing?”

Since the authorities announced what they called “Operation Cronos” against LockBit in February, the group’s leader, now identified as Dmitry Khoroshev and known under the pseudonym of has been taunting law enforcement claiming that its the effect of its takedown is exaggerated.

A law enforcement coalition that included the UK’s National Crime Agency, the US Federal Bureau of Investigation, and forces from Germany, Finland, France, Japan published that they had penetrated LockBit’s website.  The website was locked down and replaced with different content, in a clear attempt to threaten the hackers that the authorities were pursuing them. 

The February operation also included the arrests of two alleged LockBit members in Ukraine and Poland; the takedown of 34 servers across Europe, the UK, and the US; and the seizure of more than 200 cryptocurrency wallets belonging to the hackers.

LockBit was first detected t in 2019 and has subsequently turned inn to one of the most prolific ransomware gangs in the world, netting millions of dollars in ransom payments. 

Recently, the hacking collective vx-underground published on X that they had spoken to LockBit’s administrative staff, who had told them the police were lying. “I don’t understand why they’re putting on this little show. They’re clearly upset we continue to work,” the staff said, according to vx-underground.

Indeed, Lockbit has proven to be very resilient. Even after February’s takedown, the gang came back with a new dark web leak site, which has been actively updated with new apparent victims.  All the new posts on the seized website, except for one, have a countdown, suggesting that law enforcement will announce the further actions against LockBit. 

@vxunderground    |   The Record   |     Techcrunch   |    Techcrunch   |    PCMag   |    SlashDot   |   LinkedIn   | 

Guardian   |  

Image: Ideogram

You Might Also Read: 

Prioritising  Prevention Is Better Than Paying Ransom:

DIRECTORY OF SUPPLIERS - Ransomware Protection:

__________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

• Individual £5 per month or £50 per year. Sign Up

• Multi-User, Corporate & Library Accounts Available on Request

• Inquiries: Contact Cyber Security Intelligence     

Cyber Security Intelligence: Captured Organised & Accessible