Hacking the hackers: How cyber gang Lockbit was 'locked out'
Feb 20, 2024
auto_awesome
Science and technology editor Tom Clarke discusses the takedown of cyber gang Lockbit by law enforcement agencies. They cover the ransomware attacks on UK bodies like the Royal Mail and the NHS, arrests of Russians, and the implications for other cyber gangs.
International law enforcement agencies collaborated to successfully dismantle the Lockbit ransomware group.
Lockbit operated as a franchise model, providing tools for ransomware attacks and accumulating billions in cryptocurrency ransom payments.
Deep dives
Lockbit: A Franchise Model for Ransomware Attacks
Lockbit was a powerful and sophisticated ransomware organization that operated as a franchise model. They provided software, tools, and protocols to other criminals on the dark web, allowing them to carry out targeted attacks. Lockbit was responsible for 25% of ransomware attacks in the past year and had a well-established brand. Despite their technical prowess, law enforcement agencies, including the National Crime Agency (NCA) and the FBI, coordinated a successful operation to take control of the Lockbit website, rendering the group redundant. However, there is concern about the potential for backup servers and the ongoing threat from other ransomware groups.
The Mechanics of Ransomware Attacks by Lockbit
Lockbit executed ransomware attacks by gaining access to systems through cybersecurity weaknesses. Their software would then spread itself and encrypt as much data as possible on a victim's system. Once encrypted, Lockbit would demand a ransom in exchange for the decryption key. The payment amount varied based on the victim's size and was usually demanded in cryptocurrency. This method allowed Lockbit to amass billions of dollars over four years of operation, making it a lucrative and damaging criminal endeavor.
An International Effort to Combat Lockbit
The takedown of Lockbit involved extensive international cooperation between law enforcement agencies. The NCA, FBI, and other agencies from nine countries worked together in a coordinated investigation. While the operation was a success, capturing two suspects and issuing charges against two Russians, there is ongoing concern about the wider cybercrime landscape. The defeat of one group like Lockbit may lead to the rise of other types of cybercrime, such as crypto-jacking. Cybersecurity remains a significant challenge, requiring constant vigilance and investment to prevent future attacks.
One of the world's most prolific cyber crime gangs has been taken down by law enforcement agencies including the FBI, Europol and the UK's National Crime Agency.
Lockbit is an extortion website that held its victims' data for ransom - some of the biggest UK bodies affected were the Royal Mail and the NHS.
Five Russians have been charged by US authorities and dozens of crypto accounts frozen.
On the Sky News Daily, Niall Paterson is joined by science and technology editor Tom Clarke and crime correspondent Martin Brunt to discuss what Lockbit is, Operation Cronos and what this means for other cyber gangs.