One of the most active ransomware gangs in the world, the LockBit group of cybercriminals has targeted over 2,000 victims, extorted more than $120 million in ransom payments, and demanded ransoms totaling hundreds of millions of dollars. The criminal organization has been active since at least September of 2019, when it launched LockBit as ransomware-as-a-service (RaaS) for sale to hackers.
On February 21, 2024, the U.S. Department of Justice joined the United Kingdom and international law enforcement partners in London to announce a serious blow to the LockBit ransomware group. Authorities reported seizing numerous public-facing websites used by LockBit and also seizing control of servers used by LockBit administrators—thereby disrupting their ability to attack and encrypt networks and extort victims.
The announcement further stated that the U.K. National Crime Agency (NCA), in cooperation with the FBI and international law enforcement partners, has developed decryption capabilities that may enable hundreds of victims around the world to restore systems that were encrypted by LockBit ransomware. Victims are urged to contact the FBI’s Internet Crimes Complaint Center so that law enforcement can determine whether an affected system is able to be successfully decrypted.
LockBit ransomware has been active since at least September 2019, when it launched as ransomware-as-a-service (RaaS), one of the four most common types of ransomware. LockBit RaaS was made available by its creators as a for-profit product for use by other cyber criminals. Even the dark web has a commercial hierarchy.
The ransomware software was upgraded when LockBit creators rolled out LockBit 2.0 in June 2021. Six months later, in January 2022, cybercriminals added a Linux encryptor tool to specifically target VMware ESXi servers.
The Federal Bureau of Investigation was sufficiently concerned that, on February 4, 2022, they published a technical alert on the FBI Internet Crimes Complaint Center (IC3) regarding an increase in the frequency and sophistication of LockBit ransomware attacks. The alert requested that victims promptly report attacks to their local FBI Cyber Squad.
With the addition of the Linux encryptor tool in 2022, LockBit became a hybrid, combining ransomware-as-a-service and features of crypto-ransomware and locker ransomware.
Ransomware-as-a-service is so named because its creators host their various ransomware offerings on dark websites and allow other cybercriminals to purchase them on a subscription basis. Subscription fees may vary depending on a particular offering’s capabilities and are paid to the creators from the proceeds of the ransom.
Taking the crypto concept a step further, locker ransomware completely blocks access to the entire computer system. A message on the computer screen demands a ransom in exchange for access. Again, once the ransom is paid, the files become accessible.
Many victims refuse to pay the ransom because they have complete and current backups of their data. Accessing a current backup enables them to resume business operations promptly, despite the ransomware encryption of the previous working copy. Data backups may be offline or online, with both formats offering certain advantages.
The LockBit ransomware-as-a-service (RaaS) variant, like other major ransomware variants, follows this multi-step process, according to the FBI’s press release:
With the indictments unsealed on February 21, 2024, a total of five LockBit members have now been charged for their participation in the LockBit conspiracy, as detailed in the FBI press release. The five are Artur Sungatov, Ivan Kondratyev, Mikhail Pavlovich Matveev, Mikhail Vasiliev, and Ruslan Magomedovich Astamirov, all Russian nationals.
Due to its profitability, ransomware continues to be a popular cybercrime—although the LockBit disruption operation coordinated by domestic and international law enforcement organizations should throw a wrench in the LockBit machine. Still, businesses in the U.S. fall victim to ransomware on a regular basis. There are several actions to take the moment you realize your business is a ransomware target.
If you do not have a current Incident Response Plan, work with a cybersecurity firm to formulate and test a plan tailored to your organization.
To reduce the likelihood of suffering an Internet-enabled crime or cyber intrusion, the FBI urges “every user of a connected device to be aware and on guard” and to implement the following preventive actions:
In addition, employees and management should receive regular cybersecurity awareness training, including how to recognize phishing schemes, which often lead to ransomware attacks.
Ransomware continues to claim victims on a regular basis. Organizations are the most profitable targets for ransomware gangs, and unwitting employees too often serve as open doors into their organizations. Ongoing employee and management training in cybersecurity awareness, along with implementing the preventive actions urged by the FBI, have proven successful in reducing vulnerability.
Every organization should back up their data routinely and have a current Incident Response Plan in place to enable cybersecurity incidents to be addressed promptly and effectively. Working with a credentialed, experienced cybersecurity firm to proactively implement safeguards is far more attractive than the prospect of working with the FBI to try to recover ransomed data.