Thursday, February 22, 2024

LockBit Ransomware Gang Earned $91 Million Ever Since It Discovered

LockBit was one of the most widely used ransomware in 2022, targeting both small and large organizations irrespective of their size or net worth.

The threat actor group deploying this LockBit ransomware was working as a RaaS (Ransomware-as-a-service) based group with affiliates working anonymously worldwide.

The group is also said to have recruited affiliates for deploying the ransomware in various industries like government, agriculture, education, etc. The group also conducted some publicity-generating stunts to attract more people to their group.

Recent reports from CISA (Cybersecurity and Infrastructure Security Agency), the group has reportedly earned a revenue of $91 million in ransom in the United States itself, making it one of the highest-earning malware groups in history.

Attack Timeline

LockBit was discovered as part of an activity in the ABCD ransomware in 2019.  In 2020, the first LockBit-named ransomware was found in the Russian Language. The ransomware has been upgraded to version 2 in June 2021 and version 3 in March 2022.

According to the reports, 18% of the ransomware incidents reported between 1st April 2022 to 31st March 2023 included LockBit ransomware, whereas 22% of ransomware reports in Canada in 2022 were related to the same ransomware.

In addition, the FBI reported that there have been 1700 successful attacks in the US using the LockBit ransomware.

Exploitation of CVE(s)

The affiliates recruited by the LockBit ransomware group were exploiting older and newer vulnerabilities. Some of the very common vulnerabilities exploited by the affiliates were,

  • CVE-2023-0669 –  Fortra GoAnywhere Managed File Transfer (MFT) Remote Code Execution Vulnerability 
  • CVE-2023-27350 – PaperCut MF/NG Improper Access Control Vulnerability
  • CVE-2021-44228 – Apache Log4j2 Remote Code Execution Vulnerability
  • CVE-2021-22986 – F5 BIG-IP and BIG-IQ Centralised Management iControl REST Remote Code Execution Vulnerability
  • CVE-2020-1472 – NetLogon Privilege Escalation Vulnerability
  • CVE-2019-0708 – Microsoft Remote Desktop Services Remote Code Execution Vulnerability
  • CVE-2018-13379 – Fortinet FortiOS Secure Sockets Layer (SSL) Virtual Private Network (VPN) Path Traversal Vulnerability


  • Keep all the OS, hardware, firmware and software up to date
  • Control and restrict all the network connections
  • Apply local execution policies for applications
  • Disable unused ports
  • Investigate abnormal activity and other activities
  • Use Web Filtering
  • Maintain Offline backups of data and encrypt them
  • Create a recovery plan

Stop Advanced Email Threats That Target Your Business Email – Try AI-Powered Email Security


Latest articles

Leak of China’s Hacking Documentation Stunned Researchers

In a startling revelation that has sent shockwaves through the cybersecurity community, a massive...

Apex Code Vulnerabilities Let Hackers Steal Salesforce Data

Hackers target Apex code vulnerabilities in Salesforce to exploit security weaknesses, gain unauthorized access...

Beware of New AsukaStealer Steal Browser Passwords & Desktop Screens

An updated version of the ObserverStealer known as AsukaStealer was observed to be advertised as...

US to Pay $15M for Info About Lockbit Ransomware Operator Data

In a significant move against cybercrime, the U.S. government has announced a bounty of...

Earth Preta Hackers Abuses Google Drive to Deploy DOPLUGS Malware

Threat actors abuse Google Drive for several malicious activities due to its widespread use,...

Swiggy Account Hacked, Hackers Placed Orders Worth Rs 97,000

In a startling incident underscoring the growing menace of cybercrime, a woman's Swiggy account...

Beware of VietCredCare Malware that Steals businesses’ Facebook Accounts

A new cybersecurity threat targeting Facebook advertisers in Vietnam, known as VietCredCare, has emerged....
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Live Account Takeover Attack Simulation

Live Account Take Over Attack

Live Webinar on How do hackers bypass 2FA ,Detecting ATO attacks, A demo of credential stuffing, brute force and session jacking-based ATO attacks, Identifying attacks with behaviour-based analysis and Building custom protection for applications and APIs.

Related Articles