CyberWire Daily

International effort dismantles LockBit. [Research Saturday]

May 25, 2024

Jon DiMaggio, Chief Security Strategist at Analyst1, discusses the international effort to dismantle LockBit ransomware gang's data leak site. The NCA, FBI, Europol, and other countries disrupted LockBit, collecting victim data, decryption keys, and compromising the new ransomware payload. The discussion highlights the meticulous work involved, caution when interacting with cyber criminals, and the complex relationship with the elusive leader of LockBit.

30:59

Creator website

Episode guests

Jon DiMaggio

AI Summary

AI Chapters

Episode notes

Podcast summary created with Snipd AI

Quick takeaways

Law enforcement disrupted LockBit's operations by seizing control of their infrastructure and compromising their new ransomware payload.

Innovative law enforcement tactics, including psychological methods, are redefining responses to ransomware threats and leading to significant disruptions in the cybercriminal ecosystem.

Deep dives

Unmasking Lockbit - Research and Relationship

The podcast delves into John DiMaggio's research on Lockbit from Ransomware Diaries Vol. 5. DiMaggio developed insights into Lockbit's operations by building a unique relationship with them. Despite warnings about engaging with ransomware criminals, the podcast highlights the complex dynamic between researcher and threat actor, leading to uncovering significant findings in the cyber realm.

Introduction

2min

Unmasking the LockBit Ransomware Operator

11min

Navigating Complex Enterprise Security Challenges and Streamlining Identity Management

3min

Unveiling the Enigmatic Leader

10min

Streamlining Security Reviews and Podcast Feedback Request

3min

Jon DiMaggio, a Chief Security Strategist at Analyst1, is sharing his work on "Ransomware Diaries Volume 5: Unmasking LockBit." On February 19, 2024, the National Crime Agency (NCA), a UK sovereign law enforcement agency, in collaboration with the FBI, Europol, and nine other countries under "Operation Cronos," disrupted the LockBit ransomware gang’s data leak site used for shaming, extorting, and leaking victim data.

The NCA greeted visitors to LockBit’s dark web leak site with a seizure banner, revealing they had been controlling LockBit’s infrastructure for some time, collecting information, acquiring victim decryption keys, and even compromising the new ransomware payload intended for LockBit 4.0.

The research can be found here: