Products You May Like
A group of international law enforcement agencies have successfully disrupted LockBit, the world’s largest ransomware syndicate. Britain’s National Crime Agency (NCA) and the United States Federal Bureau of Investigation (FBI) announced Tuesday that two arrests were made via collaboration with Europol, which also helped to freeze 200 cryptocurrency accounts connected with the group.
In just four years, LockBit has swiped more than $120 million from victims across the private and public sectors, from Boeing and Accenture to the UK’s Royal Mail and the port of Lisbon. The group uses ransomware to gain initial access to an organization’s computer systems, then encrypts vital data using encryption algorithms like AES (Advanced Encryption Standard) or RSA (Rivest-Shamir-Adleman). Victim organizations can only regain access to their files by paying LockBit’s ransom and receiving a decryption key. LockBit typically demands payment via cryptocurrency, as crypto transactions are more difficult for law enforcement agencies to trace.
Credit: Mika Baumeister/Unsplash
The NCA and FBI reportedly used a different path to lock down LockBit’s enterprise. Details are scarce, but the FBI said investigators seized “numerous public-facing websites used by LockBit to connect to the organization’s infrastructure and seizing control of servers used by LockBit administrators.” LockBit is said to have used a “bespoke” infiltration tool called Stealbit, which it used to lock down victims’ data. Investigators have gained control of Stealbit and taken down 28 servers belonging to LockBit affiliates.
Europol authorities also seized 200 cryptocurrency accounts associated with ransom transactions. In Poland and Ukraine, Europol arrested two individuals thought to have been LockBit affiliates. The FBI is meanwhile working to pursue a freshly unsealed indictment alleging the involvement of two Russian nationals, Artur Sungatov and Ivan Kondratyev, with LockBit’s criminal activity against US-based businesses.
Attorney General Merrick Garland shared Tuesday that law enforcement has “obtained keys from the seized infrastructure to help victims decrypt their captured systems and regain access to their data.” The FBI is encouraging LockBit victims to fill out a questionnaire that will help law enforcement recover encrypted data and assist with efforts to prosecute LockBit threat actors.