Feds Seize LockBit Ransomware Websites, Offer Decryption Tools, Troll Affiliates
Summary: U.S. and U.K. authorities seized LockBit's darknet sites under "Operation Cronos," taking down 34 servers across eight countries, arresting two alleged members in Poland and Ukraine, unsealing indictments against two Russian nationals, releasing a free decryption tool, and freezing more than 200 cryptocurrency accounts. LockBit, which surfaced in September 2019 and operated as ransomware-as-a-service with affiliates keeping 60 to 80 percent of ransoms, has claimed more than 2,000 victims and extorted over $120 million.
What's compelling: LockBit's own leader said the FBI and NCA got in through a known PHP vulnerability that the group's bug bounty program never flagged - the same infrastructure failure that let investigators see each affiliate's ties to groups like FIN7, Wizard Spider, and EvilCorp. With five affiliates now charged and a countdown timer running toward doxing LockBitSupp, the question for defenders is how much of that affiliate visibility the takedown actually disrupts, and how much simply migrates to the next ransomware brand.
Read the original at Krebs on Security ↗
- Topics
- Ransomware
- Related
- Ransomware Defense Using the Wazuh Open Source Platform Cyber Risks ·