US to Pay $15M for Info About Lockbit Ransomware Operator Data

In a significant move against cybercrime, the U.S. government has announced a bounty of up to $15 million for information that could lead to the identification, arrest, or conviction of individuals associated with the notorious LockBit ransomware group.

This announcement comes as part of a broader crackdown on ransomware operations that have caused extensive damage to numerous organizations worldwide.

Document
Live Account Takeover Attack Simulation

How do Hackers Bypass 2FA?

Live attack simulation Webinar demonstrates various ways in which account takeover can happen and practices to protect your websites and APIs against ATO attacks .

Background on LockBit

LockBit is a ransomware-as-a-service (RaaS) operation, which means its developers create ransomware software that affiliates then deploy against victims.

The group has been responsible for high-profile cyberattacks, including those on chipmaker TSMC, consulting firm Accenture, and a Foxconn subsidiary.

LockBit Ransomware Operator DataLockBit Ransomware Operator Data
LockBit Ransomware Operator Data (Image Source: U.S. Department of State)

In 2022, LockBit was identified as the most deployed ransomware variant globally by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

Law Enforcement Actions

Recently, international law enforcement agencies, including Europol and the U.K.’s National Crime Agency, have seized LockBit’s dark website, replacing it with a notice of control by authorities.

This operation, known as “Operation Cronos,” involved the FBI and other law enforcement organizations from Australia, Japan, and Europe.

The takedown of LockBit’s operations is considered a significant victory in the fight against ransomware.

The U.S. Department of State’s Rewards for Justice program is offering the bounty, which includes $10 million for information on key leaders of the LockBit group and an additional $5 million for information leading to the arrest or conviction of anyone conspiring or attempting to participate in LockBit’s ransomware attacks.

Ransomware attacks have become increasingly prevalent, with payments to attackers exceeding $1 billion in 2023.

LockBit, in particular, has been one of the most active groups, with its ransomware variant targeting over 2,000 victims and receiving more than $120 million in ransom payments.

The Challenge Ahead

Despite the recent law enforcement success, the adaptability of ransomware gangs poses a continuous challenge.

LockBit’s operators are believed to be based in Russia, complicating efforts for arrest due to geopolitical tensions.

However, the U.S. government’s substantial reward offer underscores the seriousness with which it is pursuing these cyber criminals.

The U.S. government’s reward offer marks a critical step in the global effort to combat ransomware.

By incentivizing information that could lead to the dismantling of LockBit, authorities aim to disrupt the ransomware ecosystem and prevent future attacks.

The fight against cybercrime remains a top priority, with the U.S. and its international partners committed to tracking down and prosecuting those responsible for these malicious activities.

You can block malware, including Trojans, ransomware, spyware, rootkits, worms, and zero-day exploits, with Perimeter81 malware protection. All are extremely harmful, can wreak havoc, and damage your network.

Stay updated on Cybersecurity news, Whitepapers, and Infographics. Follow us on LinkedIn & Twitter.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Zero-Trust Policy Bypass Enables Exploitation of Vulnerabilities and Manipulation of NHI Secrets

A new project has exposed a critical attack vector that exploits protocol vulnerabilities to disrupt…

2 days ago

Threat Actor Sells Burger King Backup System RCE Vulnerability for $4,000

A threat actor known as #LongNight has reportedly put up for sale remote code execution…

2 days ago

Chinese Nexus Hackers Exploit Ivanti Endpoint Manager Mobile Vulnerability

Ivanti disclosed two critical vulnerabilities, identified as CVE-2025-4427 and CVE-2025-4428, affecting Ivanti Endpoint Manager Mobile…

2 days ago

Hackers Target macOS Users with Fake Ledger Apps to Deploy Malware

Hackers are increasingly targeting macOS users with malicious clones of Ledger Live, the popular application…

2 days ago

EU Targets Stark Industries in Cyberattack Sanctions Crackdown

The European Union has escalated its response to Russia’s ongoing campaign of hybrid threats, announcing…

2 days ago

Venice.ai’s Unrestricted Access Sparks Concerns Over AI-Driven Cyber Threats

Venice.ai has rapidly emerged as a disruptive force in the AI landscape, positioning itself as…

2 days ago