Learning from the LockBit Takedown

• At 4:00 PM ET on February 19, 2024, the authorities took action to disrupt and dismantle the LockBit ransomware-as-a-service (RaaS) infrastructure, seize funds, and arrest two individuals. The authorities placed a seizure notice on the LockBit site.

• Operation Cronos seized more than 11,000 domains and 34 servers.

• More than 14,000 rogue accounts responsible for exfiltration and 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States, and the United Kingdom have been closed.

• At 6:30PM ET, the seizure notice was replaced by a site detailing the activities of Operation Cronos.

• The Department of Justice charged a total of five LockBit affiliates and issued three arrest warrants.

• Two LockBit actors have been arrested in Poland and Ukraine.

• All StealBit servers used by the LockBit StealBit data exfiltration tool have been taken offline.

• All accounts affiliated with LockBit 3.0 are known to authorities.

• More than 200 cryptocurrency accounts have been frozen.

• US sanctions have been published.

• Approximately 1,000 potential decryption keys have been seized by the FBI, the U.K. National Crime Agency’s (NCA) Cyber Division, and Europol who are working to engage with 1,600+ known US victims via the IC3 website. 

• Victims in the United States are encouraged to reach out to your local FBI office or fill out the form on lockbitvictims.ic3.gov.

Since its emergence, LockBit has been the most deployed ransomware variant in the world. For four years, the LockBit gang sowed fear among enterprises and governments worldwide and contributed to a significant share of ransomware attacks. An Akamai research report from 2023 highlights that LockBit influenced the ransomware scene with 39% of the total ransomware victims (1,091 victims) — more than triple the number of the second-highest ranked ransomware gang.

Since January 2020, LockBit has been responsible for hundreds of attacks worldwide. In the Asia-Pacific region, it targeted organizations across financial services, critical infrastructure, agriculture, education, and government. LockBit also recruited minimally skilled attackers as affiliates, which amplified the scale, reach, and damage caused by their signature ransomware attacks. LockBit leaked the sensitive data of the organizations that refused to pay the ransom to coerce payment.

• LockBit 1.0 was released in January 2020 as ABCD ransomware.

• Lockbit 2.0 (aka LockBit Red) was released in June 2021 with StealBit, a data exfiltration tool to perform ransomware operations. The gang and its affiliates would drop this ransomware in compromised environments.

• LockBit Linux was released in October 2021 as a Linux encryptor targeting the popular VMware vSphere platform and the ESXi virtualization platform (Figure 3).

• LockBit 3.0 (aka LockBit Black) was released in March 2022 to exfiltrate sensitive company data files before encryption by using StealBit and rclone exfiltration tools, which LockBit commonly used, as a public file-sharing service.

• Lockbit Green was reported by vx-underground and released in January 2023. It is ransomware based on the leaked code of the Conti encryptor and designed to target cloud services. It uses BCryptGenRandom for faster encryption. As with other variants, files are encrypted until a ransom is paid or data leaked for double extortion.

This was a bold takedown realized by the collaboration of authorities across many countries. However, relying on multinational task forces to take down ransomware gangs and recover decryptor keys is not an effective security strategy. Prevention is better than recovery.

Ransomware gangs are nimble and a variant of the LockBit gang could fill the newly created void and take over with even more damaging tools. The ransomware gangs are learning and will adapt to avoid the tools and techniques used by the authorities. Additionally they have still have a number of attacks that they completed they will try to monetize.

Let’s keep in mind the attempted takedown of another prolific ransomware group, BlackCat/ALPHV, which “UNSEIZED” their dark website hours after it was seized by the FBI: They posted the image of a black cat and a banner declaring "THIS WEBSITE HAS BEEN UNSEIZED." The gang is still at large and the U.S. State Department is offering up to a US$10million bounty for information on the group's leaders.

There are five key elements in an effective security strategy. The first step is to prepare by identifying every asset and application in your IT environment.

Then, you must prevent attackers from accessing and encrypting the data on critical servers — and have backups in the event that attackers are able to breach an environment. You can minimize the impact of any potential access through segmentation. Implementing a Zero Trust architecture, starting with software-defined microsegmentation to prevent lateral movement after ransomware infection, is critical.

Full network visibility to identify indicators of compromise (IOCs) will enable the third and fourth steps: detection and remediation before malware can have a larger impact. Visibility also helps guide compliance with local cybersecurity regulations.

Finally, it is essential to have a thorough understanding of attack surfaces, along with strong processes and playbooks to prevent and recover from ransomware attacks.