Back from the dead: LockBit taunts cops, threatens to leak Trump docs
(2024/02/26)
- Reference: 1708974844
- News link: https://www.theregister.co.uk/2024/02/26/lockbit_back_in_action/
- Source link:
Updated LockBit claims it's back in action just days after an international law enforcement effort seized the ransomware gang's servers and websites, and retrieved more than 1,000 decryption keys to assist victims.
The crew's latest leak site, which debuted on Saturday, listed more than a dozen [1]alleged victims including the FBI itself, [2]hospitals , and Georgia's Fulton County, which is still [3]struggling to recover from the intrusion that [4]disrupted its phone, email and other IT systems in late January.
LockBit [5]claimed to be responsible for the Fulton County break-in before the UK's National Crime Agency (NCA) and US FBI [6]took down its infrastructure last week. The Georgia county, however, has reappeared on the crew's Tor site, with a countdown clock set to expire on March 2 unless government officials pay the ransom demand.
[7]
The criminal gang claims to have a trove of Fulton confidential data such as the [8]identities of jurors serving on a murder trial that " [9]could put lives at risk and jeopardize a number of other criminal trials," according to Krebs on Security.
[10]
[11]
The crew also claimed the stolen Fulton collection includes documents related to Donald Trump's court cases, which will be released unless the ransom is paid. Fulton County did not immediately respond to The Register 's request for comment.
I am very pleased that the FBI has cheered me up
After [12]confiscating LockBit's infrastructure on February 20, [13]arresting members of the ransomware gang and using its website to [14]leak secrets about the crew's operations, law enforcement promised its big reveal would happen on Friday with the identity of LockBitSupp, the group's public spokesperson.
That turned out to be a [15]big dud , and on Saturday LockBitSupp posed a [16]long, rambling response to the FBI, later clarifying that by "FBI," they mean all law enforcement, and continuing to taunt the federal cops:
"I am very pleased that the FBI has cheered me up, energized me and made me get away from entertainment and spending money, it is very hard to sit at the computer with hundreds of millions of dollars, the only thing that motivates me to work is strong competitors and the FBI, there is a sporting interest and desire to compete," LockBitSupp opined.
[17]
The character also claimed that Operation Cronos hacked the gang's servers by exploiting a [18]PHP vulnerability : "Due to my personal negligence and irresponsibility I relaxed and did not update PHP in time."
[19]LockBit extorted billions of dollars from victims, fresh leaks suggest
[20]LockBit identity reveal a bigger letdown than Game of Thrones Season 8
[21]Authorities dismantled LockBit before it could unleash revamped variant
[22]LockBit leaks expose nearly 200 affiliates and bespoke data-stealing malware
The site admin also alleges that law enforcement took down LockBit specifically to prevent the release of stolen documents containing "a lot of interesting things and Donald Trump's court cases that could affect the upcoming US election."
Additionally, LockBitSupp claims the decryptors seized "are of little use," and says there were almost 20,000 on the hacked server, "most of which were protected and cannot be used by the FBI." ®
Updated to add
"The FBI and its partners anticipated Lockbit threat actors would attempt to regroup and rebuild, however, the opportunity to offer over a thousand victims the ability to decrypt their networks is our focus and we will continue to provide assistance to those who have been impacted," the agency told us.
"While a subject can stand up new infrastructure, we made it more difficult for them to operate, prevented countless new victims, and tarnished its reputation as the most prolific ransomware in existence. The FBI continues to maintain our disruptive activities against cyber actors threatening security for any organization or individual."
Get our [23]Tech Resources
[1] https://cyberplace.social/@GossiTheDog/111997870208713842
[2] https://twitter.com/AlvieriD/status/1762112976578826671
[3] https://www.fultoncountyga.gov/news/2024/02/22/fulton-county-cyber-incident-response-update-february-22
[4] https://www.fultoncountyga.gov/news/2024/02/02/fulton-county-outage-contact-information
[5] https://twitter.com/AlvieriD/status/1757658538355073357
[6] https://www.theregister.com/2024/02/20/lockbit_down_operation_cronos/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zd0YHhEIf6kVi0iAxoOeOQAAABM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[8] https://theatlantaobjective.substack.com/p/the-fulton-county-hack-is-a-ticking
[9] https://krebsonsecurity.com/2024/02/fbis-lockbit-takedown-postponed-a-ticking-time-bomb-in-fulton-county-ga/#more-66495
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zd0YHhEIf6kVi0iAxoOeOQAAABM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zd0YHhEIf6kVi0iAxoOeOQAAABM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2024/02/20/nca_lockbit_takedown/
[13] https://www.theregister.com/2024/02/22/ukrainian_police_arrest_father_and/
[14] https://www.theregister.com/2024/02/21/lockbit_leaks/
[15] https://www.theregister.com/2024/02/23/lockbit_identity_reveal/
[16] https://samples.vx-underground.org/tmp/Lockbit_Statement_2024-02-24.txt
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zd0YHhEIf6kVi0iAxoOeOQAAABM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[18] https://nvd.nist.gov/vuln/detail/CVE-2023-3824
[19] https://www.theregister.com/2024/02/23/lockbit_extorted_billions_of_dollars/
[20] https://www.theregister.com/2024/02/23/lockbit_identity_reveal/
[21] https://www.theregister.com/2024/02/22/lockbit_dismantled_new_variant/
[22] https://www.theregister.com/2024/02/21/lockbit_leaks/
[23] https://whitepapers.theregister.com/
The crew's latest leak site, which debuted on Saturday, listed more than a dozen [1]alleged victims including the FBI itself, [2]hospitals , and Georgia's Fulton County, which is still [3]struggling to recover from the intrusion that [4]disrupted its phone, email and other IT systems in late January.
LockBit [5]claimed to be responsible for the Fulton County break-in before the UK's National Crime Agency (NCA) and US FBI [6]took down its infrastructure last week. The Georgia county, however, has reappeared on the crew's Tor site, with a countdown clock set to expire on March 2 unless government officials pay the ransom demand.
[7]
The criminal gang claims to have a trove of Fulton confidential data such as the [8]identities of jurors serving on a murder trial that " [9]could put lives at risk and jeopardize a number of other criminal trials," according to Krebs on Security.
[10]
[11]
The crew also claimed the stolen Fulton collection includes documents related to Donald Trump's court cases, which will be released unless the ransom is paid. Fulton County did not immediately respond to The Register 's request for comment.
I am very pleased that the FBI has cheered me up
After [12]confiscating LockBit's infrastructure on February 20, [13]arresting members of the ransomware gang and using its website to [14]leak secrets about the crew's operations, law enforcement promised its big reveal would happen on Friday with the identity of LockBitSupp, the group's public spokesperson.
That turned out to be a [15]big dud , and on Saturday LockBitSupp posed a [16]long, rambling response to the FBI, later clarifying that by "FBI," they mean all law enforcement, and continuing to taunt the federal cops:
"I am very pleased that the FBI has cheered me up, energized me and made me get away from entertainment and spending money, it is very hard to sit at the computer with hundreds of millions of dollars, the only thing that motivates me to work is strong competitors and the FBI, there is a sporting interest and desire to compete," LockBitSupp opined.
[17]
The character also claimed that Operation Cronos hacked the gang's servers by exploiting a [18]PHP vulnerability : "Due to my personal negligence and irresponsibility I relaxed and did not update PHP in time."
[19]LockBit extorted billions of dollars from victims, fresh leaks suggest
[20]LockBit identity reveal a bigger letdown than Game of Thrones Season 8
[21]Authorities dismantled LockBit before it could unleash revamped variant
[22]LockBit leaks expose nearly 200 affiliates and bespoke data-stealing malware
The site admin also alleges that law enforcement took down LockBit specifically to prevent the release of stolen documents containing "a lot of interesting things and Donald Trump's court cases that could affect the upcoming US election."
Additionally, LockBitSupp claims the decryptors seized "are of little use," and says there were almost 20,000 on the hacked server, "most of which were protected and cannot be used by the FBI." ®
Updated to add
"The FBI and its partners anticipated Lockbit threat actors would attempt to regroup and rebuild, however, the opportunity to offer over a thousand victims the ability to decrypt their networks is our focus and we will continue to provide assistance to those who have been impacted," the agency told us.
"While a subject can stand up new infrastructure, we made it more difficult for them to operate, prevented countless new victims, and tarnished its reputation as the most prolific ransomware in existence. The FBI continues to maintain our disruptive activities against cyber actors threatening security for any organization or individual."
Get our [23]Tech Resources
[1] https://cyberplace.social/@GossiTheDog/111997870208713842
[2] https://twitter.com/AlvieriD/status/1762112976578826671
[3] https://www.fultoncountyga.gov/news/2024/02/22/fulton-county-cyber-incident-response-update-february-22
[4] https://www.fultoncountyga.gov/news/2024/02/02/fulton-county-outage-contact-information
[5] https://twitter.com/AlvieriD/status/1757658538355073357
[6] https://www.theregister.com/2024/02/20/lockbit_down_operation_cronos/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Zd0YHhEIf6kVi0iAxoOeOQAAABM&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[8] https://theatlantaobjective.substack.com/p/the-fulton-county-hack-is-a-ticking
[9] https://krebsonsecurity.com/2024/02/fbis-lockbit-takedown-postponed-a-ticking-time-bomb-in-fulton-county-ga/#more-66495
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zd0YHhEIf6kVi0iAxoOeOQAAABM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Zd0YHhEIf6kVi0iAxoOeOQAAABM&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2024/02/20/nca_lockbit_takedown/
[13] https://www.theregister.com/2024/02/22/ukrainian_police_arrest_father_and/
[14] https://www.theregister.com/2024/02/21/lockbit_leaks/
[15] https://www.theregister.com/2024/02/23/lockbit_identity_reveal/
[16] https://samples.vx-underground.org/tmp/Lockbit_Statement_2024-02-24.txt
[17] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Zd0YHhEIf6kVi0iAxoOeOQAAABM&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[18] https://nvd.nist.gov/vuln/detail/CVE-2023-3824
[19] https://www.theregister.com/2024/02/23/lockbit_extorted_billions_of_dollars/
[20] https://www.theregister.com/2024/02/23/lockbit_identity_reveal/
[21] https://www.theregister.com/2024/02/22/lockbit_dismantled_new_variant/
[22] https://www.theregister.com/2024/02/21/lockbit_leaks/
[23] https://whitepapers.theregister.com/
Anonymous Coward
Not sure that releasing any of the files related the the Great Orange One will hurt any of his cases. It will probably just boost his poll numbers.
markrand
That's the threat...
NCA
elsergiovolador
So we have a really rare occasion to see that NCA is actually doing something (who cares if we have massive corruption in the government, PPE fraud, VIP lanes, IR35 changes to benefit certain businesses, written off loans and so on...)
...and they blew it.
xD
so, they save 1 out of 20. I'm guessing Fulton County wasn't one of them....