Lockbit ransomware gang’s origins, tactics and past targets – and what next after policing breakthrough
The provider of the world’s top ransomware threat may have finally been thwarted by Operation Cronos, an international policing effort to hack the hackers led by the UK. Here’s everything you need to know about the notorious criminal gang.
An infamous cyber crime gang has been disrupted by the National Crime Agency (NCA) and a coalition of international police agencies.
Lockbit and its affiliates have hacked some of the world’s largest organisations in recent months, but as of Monday their extortion website displays a message saying it is “under the control of the National Crime Agency of the UK”.
Five Russian nationals have been charged.
But what is Lockbit, what are its criminal tactics and who has fallen victim to it? Here’s what we know…
What Lockbit does
The gang makes money by stealing sensitive data and threatening to leak it if victims fail to pay an extortionate ransom.
Its affiliates are like-minded criminal groups that are recruited to wage attacks using Lockbit’s digital extortion tools.
US officials have described Lockbit as the world’s top ransomware threat. The group has hit organisations in nearly every industry; from financial services and food to schools, transportation and government departments.
The gang has caused losses of billions of pounds, dollars and euros, both in ransom payments and in the costs of recovery, according to the UK’s National Cyber Security Centre (NCSC).
Lockbit’s website, until Monday, displayed an ever-growing gallery of victim organisations that was updated almost daily.
Next to their names were digital clocks that showed the number of days left to the deadline given to each organisation to provide ransom payment.
Lockbit ransomware has been deemed responsible for at least 1,700 attacks in the US alone by the FBI.