Interview with a LockBit ransomware operator
Summary: Cisco Talos established contact with a self-described LockBit operator in September 2020 and conducted multiple interviews over several weeks, producing a first-hand account of a ransomware operator's activities. LockBit is described as a ransomware-as-a-service platform known for its automation and the speed at which it attacks victims.
Why it matters: The operator's own account of running a RaaS operation gives defenders a direct view of how threat actors think about the technology and the business of ransomware, rather than an outside reconstruction of their methods.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026