Tuesday, February 11, 2025
HomeCyber Security NewsLockBit Ransomware Gang Earned $91 Million Ever Since It Discovered

LockBit Ransomware Gang Earned $91 Million Ever Since It Discovered

Published on

SIEM as a Service

Follow Us on Google News

LockBit was one of the most widely used ransomware in 2022, targeting both small and large organizations irrespective of their size or net worth.

The threat actor group deploying this LockBit ransomware was working as a RaaS (Ransomware-as-a-service) based group with affiliates working anonymously worldwide.

The group is also said to have recruited affiliates for deploying the ransomware in various industries like government, agriculture, education, etc. The group also conducted some publicity-generating stunts to attract more people to their group.

Recent reports from CISA (Cybersecurity and Infrastructure Security Agency), the group has reportedly earned a revenue of $91 million in ransom in the United States itself, making it one of the highest-earning malware groups in history.

Attack Timeline

LockBit was discovered as part of an activity in the ABCD ransomware in 2019.  In 2020, the first LockBit-named ransomware was found in the Russian Language. The ransomware has been upgraded to version 2 in June 2021 and version 3 in March 2022.

According to the reports, 18% of the ransomware incidents reported between 1st April 2022 to 31st March 2023 included LockBit ransomware, whereas 22% of ransomware reports in Canada in 2022 were related to the same ransomware.

In addition, the FBI reported that there have been 1700 successful attacks in the US using the LockBit ransomware.

Exploitation of CVE(s)

The affiliates recruited by the LockBit ransomware group were exploiting older and newer vulnerabilities. Some of the very common vulnerabilities exploited by the affiliates were,

  • CVE-2023-0669 –  Fortra GoAnywhere Managed File Transfer (MFT) Remote Code Execution Vulnerability 
  • CVE-2023-27350 – PaperCut MF/NG Improper Access Control Vulnerability
  • CVE-2021-44228 – Apache Log4j2 Remote Code Execution Vulnerability
  • CVE-2021-22986 – F5 BIG-IP and BIG-IQ Centralised Management iControl REST Remote Code Execution Vulnerability
  • CVE-2020-1472 – NetLogon Privilege Escalation Vulnerability
  • CVE-2019-0708 – Microsoft Remote Desktop Services Remote Code Execution Vulnerability
  • CVE-2018-13379 – Fortinet FortiOS Secure Sockets Layer (SSL) Virtual Private Network (VPN) Path Traversal Vulnerability

Mitigations

  • Keep all the OS, hardware, firmware and software up to date
  • Control and restrict all the network connections
  • Apply local execution policies for applications
  • Disable unused ports
  • Investigate abnormal activity and other activities
  • Use Web Filtering
  • Maintain Offline backups of data and encrypt them
  • Create a recovery plan

Stop Advanced Email Threats That Target Your Business Email – Try AI-Powered Email Security

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

OpenAI Developing Its Own Chip to Reduce Reliance on Nvidia

OpenAI, the organization behind ChatGPT and other advanced AI tools, is making significant strides...

New York Bans DeepSeek Over Potential Data Risks

 New York Governor Kathy Hochul announced that the state has banned the use of...

Hackers Exploit Valentine’s Day Domains for Sneaky Cyber Attacks

Cybercriminals are capitalizing on the season of love to launch sneaky and deceptive cyberattacks.According...

EARLYCROW: Detecting APT Malware Command and Control Activities Over HTTPS

Advanced Persistent Threats (APTs) represent a sophisticated and stealthy category of cyberattacks targeting critical...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

OpenAI Developing Its Own Chip to Reduce Reliance on Nvidia

OpenAI, the organization behind ChatGPT and other advanced AI tools, is making significant strides...

New York Bans DeepSeek Over Potential Data Risks

 New York Governor Kathy Hochul announced that the state has banned the use of...

Hackers Exploit Valentine’s Day Domains for Sneaky Cyber Attacks

Cybercriminals are capitalizing on the season of love to launch sneaky and deceptive cyberattacks.According...