In a coordinated international law enforcement operation on February 19, the notorious LockBit ransomware gang had its Dark Web infrastructure seized by authorities. LockBit is accused of extorting hundreds of companies and organizations globally by encrypting their data and demanding massive ransoms.
In an unusual public mockery of the criminal hackers, authorities replaced LockBit's website with their own message, claiming to know the identity of its leader known as "LockbitSupp." Police taunted that LockbitSupp "has engaged with law enforcement," hinting he may be compromised as an informant. And while not exposing his actual identity, law enforcement did claim to know who he is, where he lives, and how much he's worth.
The brazen takedown and online ridicule was "a psychological operation" designed to undermine trust in LockBit, according to experts. By co-opting the ransomware group's own communication channels, police aimed to sow doubts in the cybercrime community reliant on LockBit's tools and services.
But by February 25, LockBit had announced its return on new servers, downplaying the breach of its operations. In a lengthy message, LockBit admitted "negligence" over an outdated PHP server vulnerability that enabled its infrastructure seizure. However, it claimed critical systems like ransom payment tracking remained unaffected due to backups.
To prevent another takedown, LockBit says it will decentralize infrastructure and manually handle processes like releasing decryption software. Nonetheless, Dr. Ilia Kolochenko, CEO of cybersecurity firm ImmuniWeb, said he believes that while showing resilience, LockBit likely suffered permanent damage:
"The resurrection is not surprising. LockBit is a mature, well-organized, and seasoned cybercrime group that cannot be easily dismantled compared to smaller ransomware entities that were elegantly smashed by joint operations of law enforcement agencies in 2023."
Nonetheless... authorities managed to get a full list of victims, payments, and other details of LockBit's ransomware empire. First, this data can potentially serve as invaluable intelligence for further investigations that may eventually expose the whereabouts and identities of LockBit's members."
So while LockBit scrambles to regain its footing, the secrets uncovered from its digital underbelly could ultimately support its complete undoing. And affiliates may hesitate to keep relying on the supposed king of ransom malware once he's been dethroned—if only temporarily.