Law enforcement takes over ransomware group LockBit
LONDON — Law enforcement agencies have infiltrated and disrupted LockBit, arresting two people involved with the prolific ransomware syndicate that has extracted $120 million from thousands of victims worldwide, British, U.S. and European officials said Tuesday.
Britain’s National Crime Agency, or NCA, said it led an international operation targeting LockBit, which provides ransomware as a service to so-called affiliates who infect victim networks with the computer-crippling malware and negotiate ransoms.
The operation resulted in the arrests of two people in Poland and Ukraine and the seizure of 200 cryptocurrency accounts, officials said at a joint news conference. The Justice Department, meanwhile, unsealed indictments against two more people, both Russian nationals. Authorities said they gained “comprehensive access” to LockBit’s systems, taking control of infrastructure and obtaining keys to help victims decrypt their data.
“We have hacked the hackers,” Graeme Biggar, the NCA’s director general, said at the news conference in London.
Hours before the announcement, the front page of LockBit’s darkweb leak site was replaced with the words “this site is now under control of law enforcement,” alongside the flags of the U.K., the U.S. and several other nations.
The message said the U.K.’s NCA was “working in close cooperation with the FBI and the international law enforcement task force, Operation Cronos.” The continuing operation also involves agencies from Germany, France, Japan, Australia, New Zealand and Canada, among others, including Europol, it said.
The announcement brings to five the number of people the U.S. has indicted since the operation began. Three Russians have previously been indicted, with two of those taken into custody, one in Canada and one in the U.S. The rest are still wanted.
Authorities said they also seized servers that the gang used to organize and transfer victim data, and gained access to nearly 1,000 potential decryption tools. They also obtained the LockBit platform’s source code and intelligence on people it worked with.
LockBit, which has been operating since 2019, has been the most prolific ransomware syndicate two years running. The group accounted for 23% of the nearly 4,000 attacks globally last year in which ransomware gangs posted data stolen from victims to extort payment, according to the cybersecurity firm Palo Alto Networks.
The operation is “probably the most significant ransomware disruption to date,” Analyst Brett Callow of the cybersecurity firm Emsisoft said. And while it will likely spell the end of the brand, such groups routinely re-emerge under new names. Over the long term, Callow said, this operation alone will not diminish the volume of ransomware attacks.
LockBit is dominated by Russian speakers, but officials suggested there’s no evidence that a nation state such as Russia is behind it.