In a collaboration between several major police forces worldwide, the website for ransomware group LockBit has been taken and disrupted the operations of one of the worlds largest cybercrime groups.
LockBit Website Taken
As reported by cyberscoop.com, the LockBit website has been seized by the UK’s National Crime Agency in cooperation with the FBI and over international law enforcement partners under ‘Operation Cronos’. Some of the countries involved with this include Germany, Finland, The Netherlands, France, Japan and Canada. A Senior FBI official spoke to cyberscoop and claimed that they had “taken control of the site used to leak data, their file share service, communications server, various affiliate and support servers , and a server for LockBit’s administrative panel.”
A representative of LockBit has also supposedly confirmed the website seizing as shared by Twitter user VX-underground which shows the LockBit user stating “FBI pwned me”.
LockBit first appeared back in September 2019 and since has been suspected to have received more than $144 million in ransomware payments from at least 2,000 businesses and entities around the world. In the UK the group was behind attacks on Royal Mail back near the beginning of 2023.
The group is said to be made up of many “affiliates” but is claimed to primarily be a Russian based group which due to current events, gives them some protection from the Russian Government in attacking Western targets.
Previously operations against large ransomware groups have only caused temporary disruption, for example BlackCat, however the FBI representative is confident that this will hold due to the actions used to disrupt Lockbit were done in a “completely different manner than BlackCat”. The representative does admit that it is still possible for it to “reconstitute” but “LockBit will be unable to regain control of the servers the actors were using.”
It’s good news in a way, but at the same time Ransomware is a never-ending battle and more groups will always crop up.
