Earlier today, a reader asked “What happened with LockBit today? They’re all over the news.” Probably a question that a lot of people have, so let’s dive in and spell it out!
First things first, who or what is LockBit? Starting life as a ransomware gang some time ago, LockBit has been responsible for attacking the infrastructure and data systems 
of everything from small sole-proprietorships to multinational organizations. Tactics varied, but their primary operations revolved around double-extortion ransomware: where a copy of victim data is first removed from the environment and sent to LockBit servers in the cloud, then the original data is encrypted and rendered unusable to the victim organization. This allowed LockBit to demand payment for decryption of the data, but also to threaten to make all the stolen data public if the victim org decided they didn’t want to pay for the decryption itself. In this way, LockBit had multiple avenues of extortion to bring to bear in order to get paid by the victim. More recently, LockBit branched out into Ransomware as a Service, where they would create tool-kits and host infrastructure for other criminals to use when performing ransomware attacks against victims, with LockBit getting a cut of the criminally-acquired funds.
Now on to what happened: Early in the morning of Feb 20 here in the US, a coalition of law enforcement groups led by the National Crime Agency (NCA) in the United Kingdom and the FBI in the USA struck hard at the LockBit web infrastructure. In addition to many other operations – including multiple arrests of high-ranking LockBit members in multiple countries – law enforcement took down the dark-web back-end systems and the website that drove the Ransomware as a Service platform, effectively rendering the system useless for hundreds of affiliates of LockBit. The website itself was replaced with new information: First was a fairly standard notification that law enforcement agencies had seized the website and affiliated domains. As this site is where LockBit and their affiliates posted victim information if they didn’t pay up, this was a massive blow to the organization as a whole. Shortly after, however, this placeholder notification was itself replaced with a website that looked very similar to the original LockBit leaks site, but now showing information about the group itself, its members, its operations, and links for victims to get help and assistance from law enforcement. In short, the site returned to doing what it did prior to the seizure, but now hosting the information on LockBit; instead of on their victims.
The operation – code-named “Cronos” – was carried out quickly and efficiently; with the entire process taking just a couple of hours from start to finish. The coordinated takedown of both the web infrastructure and arrest of LockBit leaders in multiple countries crippled the ransomware gang and their affiliates effectively – and even humorously – as LockBit’s own infrastructure was suddenly converted into a weapon against them and their affiliate network.
It should be noted that this crippling of the gang could be temporary. Not all suspected LockBit leaders were arrested, and dark-web infrastructure has a very nasty habit of being resurrected quickly somewhere else. That being said, for now, I think we can call this a total win for law enforcement and a complete loss for LockBit and their Ransomware as a Service affiliate groups.
One only wonders, will LockBit now be offering one year of complimentary identity protection services for their affiliates like many of organizations they attacked had to do for their customers after suffering a LockBit-affiliated attack?