Lockbit Emergence and Operations
Lockbit surfaced in 2020 with its eponymous malware appearing on Russian-language cybercrime forums. While some analysts speculated its roots in Russia, the gang claims a base in the Netherlands and asserts an apolitical stance, driven solely by financial motives.
Within a short span, Lockbit surged to become a top global ransomware threat, targeting diverse sectors worldwide, notably disrupting over 1,700 American entities across industries like finance, education, transportation, and government agencies. Notably, recent victims include Boeing and the financial trading services group ION, affecting prominent banks and hedge funds.
Ransomware Tactics
The group’s modus operandi involves infiltrating an organization’s systems with ransomware, coercing them to pay a ransom in cryptocurrency to decrypt their encrypted data. Lockbit’s dark web blog showcases an expanding list of victim organizations, each with a countdown clock signaling impending data leaks if the ransom isn’t paid.
Efforts by a 40-country alliance aim to curb ransomware by sharing intelligence on cryptocurrency wallet addresses linked to such cyber criminals. However, Lockbit’s operations persist, often prompting victim organizations to engage cybersecurity firms for data analysis and ransom negotiations, typically conducted behind closed doors and lasting days or weeks.
Private Threats and Unlisted Victims
Notably, some victims don’t appear on Lockbit’s public blog, indicating private threats. For instance, ICBC’s U.S. unit, working on recovery from a breach, didn’t feature on Lockbit’s blog.
Central to Lockbit’s success are its ‘affiliates,’ collaborating criminal groups recruited to execute attacks using Lockbit’s extortion tools. The gang’s website outlines strict protocols for potential cybercriminals seeking to join their ranks, emphasizing referrals and leveraging existing connections.
The interconnection between various cybercriminal groups complicates tracking and combating these attacks, given the divergent tactics employed in each instance.
Read More (Tech)
