The LockBit Ransomware Gang Is Surprisingly Professional
This article makes LockBit sound like a legitimate organization:
The DDoS attack last weekend that put a temporary stop to leaking Entrust data was seen as an opportunity to explore the triple extortion tactic to apply more pressure on victims to pay a ransom.
LockBitSupp said that the ransomware operator is now looking to add DDoS as an extortion tactic on top of encrypting data and leaking it.
“I am looking for dudosers [DDoSers] in the team, most likely now we will attack targets and provide triple extortion, encryption + date leak + dudos, because I have felt the power of dudos and how it invigorates and makes life more interesting,” LockBitSupp wrote in a post on a hacker forum.
The gang also promised to share over torrent 300GB of data stolen from Entrust so “the whole world will know your secrets.”
LockBit’s spokesperson said that they would share the Entrust data leak privately with anyone that contacts them before making it available over torrent.
They’re expanding: locking people out of their data, publishing it if the victim doesn’t pay, and DDoSing their network as an additional incentive.
Subscribe to comments on this entry
Clive Robinson • September 7, 2022 10:31 AM
@ Bruce, ALL,
Let’s move this towards a logical conclusion, as the Ransomware people are attackers, their job as long as they can reach their target is easier than the defenders.
Therefor their “expanding” will take them to the point where no collection of data that is online can be considered even remotely secure from their attacks.
This “has ment” that the owners of data “had” only two end game mitigations,
1, Do not have data on any system that is reachable by an attacker.
2, Do not have the data stored in a form that an attacker can use (ie enctypted)
Note the use of the “past tense” the addition of DDoS etc means that option 2 is nolonger viable.
This effectively means that all “cloud services” and all “remote working” across a network the attackers can reach out on is fully vulnerable to the attackers…
So a swing back to “in office” issolated data centers and workers is in effect the only reliable mitigation against “ransomware” opperators.
I’m sure the big cloud operators will bluster, but at the end of the day they have no actual answer to the problem. That is as long as there is connectivity that both a defender and attacker can share the attacker will win.
I can not see that many organisations wanting to pay[1] for high capacity “Private Leased Lines” direct from their offices to a Cloud Data Center.
So I suspect the pendulum will start to swing back to “In House” data centers again.
But then if you look back to when “cloud” was not much more than a name, some of us came up with a whole list of reasons why it was a bad idea. Since then one by one they’ve been shown to be “valid” as people have fallen foul of them.
[1] Not so true of organisations funded via “tax dollars” like the IC and Mil entities.