Despite arrests, infrastructure seizure and international law enforcement efforts, LockBit ransomware has resurfaced, promising robust security and threatening aggressive cyber attacks on UK and USA government sectors.
The LockBit ransomware gang has officially announced its comeback through a detailed message posted on Saturday on its newly created .onion site on the dark web.
The leader of the LockBit ransomware, whose identity is still unknown to authorities, admitted negligence in letting the FBI and the UK’s National Crime Agency control its servers via a PHP attack but promised backups and continued operations.
The announcement comes only a week after the group was neutralized in Operation Cronos, a multinational law enforcement investigation, reportedly neutralized the ransomware gang.
For your information, on 19 February 2024, as reported by Hackread.com, law enforcement authorities seized LockBit’s infrastructure, including 34 servers that hosted the gang’s data leak website storing stolen data, cryptocurrency addresses, decryption keys, and the affiliate panel causing a major setback to the notorious gang.
The message from the gang’s admin which directly addressed the FBI and the NCA, revealed that servers without PHP installed in backup blogs are unaffected and will continue to release stolen data from targeted companies, even after the FBI hack, and stolen data will be published on the LockBit blog.
The admin claims that Operation Cronos was successful because of their negligence and irresponsibility in “not updating PHP settings on their servers in good time.” They denied Operation Cronos investigators’ claims regarding arresting their two alleged affiliates, the gang donating to a Crimea-based Russian propagandist (Sevastapol Colonel Cassad), and recovering a high number of decryptors.
However, LockBit confirmed the FBI’s claim that its annual income exceeds $100m, based on data from seized cryptocurrency wallets during Operation Cronos. The group has deleted chats containing evidence of ransomware payments, indicating that their revenues exceed US law enforcement estimates. This demonstrates their success despite making mistakes.
The admin wrote that their victim’s admin chat panels server and blog server were running PHP 8.1.2 and were likely hacked using the CVE-2023-3824 vulnerability. LockBit ransomware has updated its PHP server and offering rewards for finding vulnerabilities in its latest version. LockBit has moved its data leak site to a new.onion address and has targeted five victims with countdown timers to expose the stolen data.
Regarding why the FBI hacked their infrastructure, the gang stated that their ransomware attack on Fulton County in January irked the authorities for posing the risk of leaking information on Donald Trump court cases and other “interesting things.”
LockBit claims authorities collected over 1,000 decryption keys during Operation Cronos from “unprotected decryptors,” which they defined as low-level malware builds. LockBit plans to upgrade security, manually release decryptors, host affiliate panels on multiple servers, and provide partners with access to different copies.