.
Known as an underground cybercriminal group, Lockbit employs ransomware, a type of malicious software, to extort victims online.
The group became the target of an unprecedented international law enforcement operation, resulting in the arrest of several members. Police stated that Lockbit's leadership cooperated with law enforcement, without providing further details.
In an official statement, the group claimed that law enforcement had hacked Lockbit's dark web site, where the gang leaked stolen data from its victims. "All other servers with non-PHP-installed backup blogs are unaffected and will continue to provide data stolen from attacked companies," the statement, posted in both English and Russian on Lockbit's new dark web site version, quoted from Reuters on Tuesday (27/2/2024).
A spokesperson for the UK National Crime Agency (NCA), leading the international efforts to disrupt Lockbit's operations, stated that the group "remains fully compromised." "We are aware Lockbit is likely to attempt to regroup and rebuild their systems. However, we have gathered a significant amount of intelligence about them and those associated with them, and our efforts to target and monitor them continue," said the NCA.
The new Lockbit dark web site displays a gallery of company names, each attached to a countdown clock marking the deadline by which the company is required to pay the ransom. "They want to intimidate me because they cannot find and eliminate me; I am unstoppable," the statement, revealed as part of an FBI leak, said.
Recently, the US announced the indictment of two Russian nationals for spreading Lockbit ransomware against companies and groups worldwide. Police in Poland, Ukraine, and France each arrested individuals using Lockbit malware.
Cybersecurity experts believe this operation is designed to discredit Lockbit's position among its affiliates, namely criminal groups using Lockbit tools to carry out ransomware attacks.