Prolific cybercrime gang disrupted by joint UK, US, EU operation

LockBit, a notorious cybercrime gang that holds its victims’ data to ransom, has been disrupted in a rare international law enforcement operation by Britain’s National Crime Agency, the FBI, Europol and a coalition of international police agencies, according to a post on the gang’s extortion website.

“This site is now under the control of the National Crime Agency of the UK, working in close cooperation with the FBI and the international law enforcement taskforce ‘Operation Cronos’,” the post said on February 19, The Guardian reports.

An NCA spokesperson confirmed that the agency had disrupted the gang and said the operation was “ongoing and developing”. A representative for LockBit did not respond to messages from Reuters seeking comment but did post messages on an encrypted messaging app saying it had backup servers not affected by the law enforcement action.

The US Department of Justice and the FBI did not immediately respond to requests for comment.

The post named other international police organisations from France, Japan, Switzerland, Canada, Australia, Sweden, the Netherlands, Finland and Germany.

LockBit and its affiliates have hacked some of the world’s largest organisations in recent months. The gang makes money by stealing sensitive data and threatening to leak it if victims fail to pay an extortionate ransom. Its affiliates are like-minded criminal groups it recruits to wage attacks using LockBit’s digital extortion tools.

Ransomware is malicious software that encrypts data. LockBit coerces its targets into paying ransom to decrypt or unlock that data with a digital key.

LockBit was discovered in 2020 when its malicious software was found on Russian-language cybercrime forums, leading some security analysts to believe the gang is based in Russia.

The gang has not professed support for any government, however, and no government has formally attributed it to a country. On its now defunct site on the dark web, the group said it was “located in the Netherlands, completely apolitical and only interested in money”.

“They are the Walmart of ransomware groups, they run it like a business – that’s what makes them different,” said Jon DiMaggio, chief security strategist at Analyst1, a US-based cybersecurity firm. “They are arguably the biggest ransomware crew today.”

Officials in the US, where LockBit has hit more than 1,700 organisations in nearly every industry, have described the group as the world’s top ransomware threat. Last November, LockBit published internal data from Boeing, one of the world’s largest defence and space contractors.

In early 2023, Royal Mail faced severe disruption after an attack by the group.

According to vx-underground, a cybersecurity research website, LockBit said in a statement in Russian and shared on Tox, an encrypted messaging app, that the FBI hit its servers that run on the programming language PHP.

The statement, which Reuters could not verify independently, added that it has backup servers without PHP that “are not touched”.

On X, vx-underground shared screenshots showing the control panel used by LockBit’s affiliates to launch attacks had been replaced with a message from law enforcement. “We have source code, details of the victims you have attacked, the amount of money extorted, the data stolen, chats, and much, much more,” it said.

“We may be in touch with you very soon. Have a nice day.”

Before it was taken down, LockBit’s website displayed an ever-growing gallery of victim organisations that was updated nearly daily. Next to their names were digital clocks that showed the number of days left to the deadline given to each organisation to provide ransom payment.

On February 19, LockBit’s site displayed a similar countdown, but from the law enforcement agencies who hacked the hackers: “Return here for more information at: 11.30 GMT on February 20.”

Don Smith, a vice-president of Secureworks, an arm of Dell Technologies, said LockBit was the most prolific and dominant ransomware operator in a highly competitive underground market.

“To put today’s takedown into context, based on leak site data, LockBit had a 25 per cent share of the ransomware market,” Smith said. “Their nearest rival was BlackCat, at around 8.5 per cent, and after that it really starts to fragment.

“LockBit dwarfed all other groups and today’s action is highly significant.”