LockBit responds to police sting 

Ransomware gang uploads new website, displaying 12 latest victims and minimizing consequences of partial infrastructure dismantling.  

On February 24, 2024, the LockBit ransomware gang uploaded a new version of its display website on the dark web. On February 19, 2024, an international police operation, dubbed Cronos, involving around ten countries, had led to a seizure of the previous website. The operation dismantled 22 sites and 34 servers belonging to the cybercriminal group. 

LockBit took the opportunity to display 12 new victims on the rebooted website, including a French company, Idea, an industrial packaging and logistics specialist. Moreover, the Sophos cybersecurity firm identified several new attacks since February 19, 2024, which relied on the LockBit 3.0 ransomware. However, none of the organizations mentioned confirmed the attacks.

Furthermore, the cybercriminal group posted a lengthy response to the claims made by law enforcement. LockBit states, in first person, that the authorities managed to take control of two essential servers “because, after five years of swimming in money, I became very lazy.”

“Due to my personal negligence and irresponsibility, I eased up and didn’t update the PHP servers in time,” reads the press release. The cybercriminal group also played down the effects of Cronos on its activity. In particular, LockBit claims that law enforcement only got their hands on “a few” decryption keys, and not a thousand as announced by the police coalition.