Xoxo to Prague
Summary: LockBit's dark web affiliate panels were defaced and replaced with a download link for a 7.5MB archive, paneldb_dump.zip, that extracts to a 26MB clear-text SQL dump containing 20 tables. The dump exposed nearly 60,000 Bitcoin addresses and credentials for 75 admins and affiliates with plaintext passwords, plus a chats table of 4,423 messages across 208 victims from December 2024 to April 2025, with ransom demands ranging from a few thousand dollars to $2 million.
Bottom line: The leaked chats show LockBit's 'Analytics Department' naming a victim's seven directors and their 14k each when the victim pleaded inability to pay a $100k ransom - a reminder that the pressure in these negotiations is built on research into your people, not just your systems.
Read the original at Cisco Talos ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·