Friday, May 24, 2024

NCA Unmasks and Sanctions Leader of Notorious LockBit Ransomware Group

In collaboration with US and Australian authorities, the UK’s National Crime Agency (NCA) has unmasked and sanctioned the leader of the notorious LockBit ransomware group, once considered the world’s most harmful cybercrime operation.

Russian national Dmitry Khoroshev, who went by the online alias “LockBitSupp,” was publicly identified on May 7, 2024, following an extensive international investigation dubbed Operation Cronos.

Khoroshev now faces asset freezes and travel bans from the UK, US, and Australia.


Integrate ANY.RUN in Your Company for Effective Malware Analysis

Are you from SOC, Threat Research, or DFIR departments? If so, you can join an online community of 400,000 independent security researchers:

  • Real-time Detection
  • Interactive Malware Analysis
  • Easy to Learn by New Security Team members
  • Get detailed reports with maximum data
  • Set Up Virtual Machine in Linux & all Windows OS Versions
  • Interact with Malware Safely

If you want to test all these features now with completely free access to the sandbox:

The US Department of Justice has also unsealed an indictment against him and is offering a $10 million reward for information leading to his arrest.

LockBit operated as a ransomware-as-a-service (RaaS) model, providing affiliates with tools to conduct ransomware attacks in exchange for a cut of the profits.

The group targeted organizations across critical sectors worldwide, with the US, UK, France, Germany, and China being the top 5 countries hit.

Data obtained by the NCA revealed over 7,000 LockBit attacks were built between June 2022 and February 2024, when the NCA infiltrated the group’s network and took control of its dark web leak site.

The NCA’s disruption of LockBit in February dealt a major blow to the group.

Analysis shows the average number of monthly LockBit attacks has dropped by 73% in the UK since the takedown, with the rebuilding attempt resulting in a “much less sophisticated enterprise with significantly reduced impact.”

The number of active LockBit affiliates has also fallen from 194 pre-February 2024 to just 69.

Khoroshev, despite offering a $10 million bounty for his real identity, was ultimately unable to evade authorities.

“He was certain he could remain anonymous, but he was wrong,” said NCA Director General Graeme Biggar.

The unmasking of LockBitSupp, who thrived on anonymity, sends a powerful message that there is no hiding place for ransomware operators.

The NCA and its international partners are now targeting the LockBit affiliates who conducted devastating attacks against entities like hospitals and schools.

With over 2,500 decryption keys obtained and nearly 240 UK victims proactively contacted, authorities are working to remediate the damage inflicted by the prolific ransomware group.

While the true financial impact of LockBit’s multi-year crime spree is still being uncovered, with multibillion-dollar losses estimated, this landmark operation has undoubtedly struck at the heart of the ransomware ecosystem.

“Today’s announcement puts another huge nail in the LockBit coffin,” Biggar declared.

Is Your Network Under Attack? - Read CISO’s Guide to Avoiding the Next Breach - Download Free Guide


Latest articles

Hackers Weaponizing Microsoft Access Documents To Execute Malicious Program

In multiple aggressive phishing attempts, the financially motivated organization UAC-0006 heavily targeted Ukraine, utilizing...

Microsoft Warns Of Storm-0539’s Aggressive Gift Card Theft

Gift cards are attractive to hackers since they provide quick monetization for stolen data...

Kinsing Malware Attacking Apache Tomcat Server With Vulnerabilities

The scalability and flexibility of cloud platforms recently boosted the emerging trend of cryptomining...

NSA Releases Guidance On Zero Trust Maturity To Secure Application From Attackers

Zero Trust Maturity measures the extent to which an organization has adopted and implemented...

Chinese Hackers Stay Hidden On Military And Government Networks For Six Years

Hackers target military and government networks for varied reasons, primarily related to spying, which...

DNSBomb : A New DoS Attack That Exploits DNS Queries

A new practical and powerful Denial of service attack has been discovered that exploits...

Malicious PyPI & NPM Packages Attacking MacOS Users

Cybersecurity researchers have identified a series of malicious software packages targeting MacOS users.These...
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles