In a significant crackdown on cybercrime, the US government has charged five individuals from Russia as an international operation weakens the notorious cybercrime organization known as Lockbit.
The Lockbit ransomware operation has faced a significant blow from various law enforcement agencies, including the UK’s National Crime Agency (NCA) and the FBI, culminating in their control over the gang’s ransom-demanding website.
Renowned agencies, such as the Royal Mail, were among the numerous victims that suffered considerable setbacks due to Lockbit’s criminal activities, the impact of which was notably felt in early 2023.
According to Graeme Biggar, the NCA’s Director-General, a collaborative effort of law enforcement from 10 countries successfully “hacked the hackers,” dismantling a notable ransomware site belonging to the group.
In a press briefing held in Westminster, Biggar highlighted that Lockbit has been at the forefront of ransomware attacks over the past four years, accounting for a quarter of such attacks in the previous year alone.
Lockbit’s dark website has been overtaken. Pic: Reuters
The list of victims spanned across more than 200 entities in the UK and thousands worldwide, the aftermath of which entailed multi-billion pound damages through ransom and data recovery costs, targeting key corporations and critical public services, including hospitals.
A significant data breach occurred in September of the previous year when sensitive military information was compromised following an attack on the private security firm Zaun.
Biggar clarified that Lockbit had not been directly supported by the Russian government, despite cybercrime being a tolerated offense within the country’s borders.
Charges in the US have been pressed against five Russian nationals. Two of the accused—Mikhail Vasiliev and Ruslan Magomedovich Astamirov—are currently detained, the former in Canada awaiting extradition and the latter in the US. The other three individuals—Artur Sungatov, Ivan Kondratyev, and Mikhail Pavlovich Matveev—remain fugitives.
Additionally, law enforcement efforts led to two arrests in Poland and Ukraine, as well as the freezing of over 200 cryptocurrency accounts suspected to have ties with Lockbit.
A recent statement on the group’s website proclaimed: “This site is now under the control of the National Crime Agency of the UK, working in close cooperation with the FBI and the international law enforcement task force, ‘Operation Cronos’.”
Europol, along with other international police from countries like France, Japan, Switzerland, Canada, Australia, Sweden, the Netherlands, Finland, and Germany, played a role in this significant operation.
NCA Deputy Director Paul Foster described the gang’s operations, highlighting a well-managed website with loyal customers and even a unique marketing campaign that offered $1000 for a tattoo sporting the Lockbit logo.
Evidence of the scope of their reach was apparent as Biggar explained how even those less skilled in technology could launch digital extortion attempts with just a few clicks using the gang’s tools.
Biggar’s final words on the operation were: “We have hacked the hackers; taken control of their infrastructure, seized their source code, and obtained keys that will help victims decrypt their systems. As of today, Lockbit are locked out. We have damaged the capability and most notably, the credibility of a group that depended on secrecy and anonymity.”
FAQ
Who are the five Russian nationals charged?
The US authorities have charged five Russian nationals, two of whom are in custody—Mikhail Vasiliev and Ruslan Magomedovich Astamirov. The other three—Artur Sungatov, Ivan Kondratyev, and Mikhail Pavlovich Matveev—are still at large.
What was Lockbit’s impact on global organizations?
Lockbit’s ransomware attacks have victimized more than 200 entities in the UK and thousands worldwide, with billions of pounds in collective damages due to ransom demands and data recovery efforts.
How was Lockbit disrupted?
An international law enforcement coalition of agencies, including the FBI and the National Crime Agency (NCA), managed to “hack the hackers” by taking control of their website, seizing their infrastructure, and obtaining decryption keys for victims affected by Lockbit’s operations.
Did the Russian state support Lockbit?
Although cybercrime is reportedly tolerated in Russia, Graeme Biggar from the NCA stated that there was no direct support from the Russian state to Lockbit.
What roles did international organizations play?
International law enforcement organizations such as Europol played a crucial role in assisting the NCA and FBI. Police from countries like France, Japan, Switzerland, Canada, Australia, Sweden, the Netherlands, Finland, and Germany were involved as well.
Conclusion
The collaborative international law enforcement operation targeting the notorious Lockbit ransomware gang has resulted in significant disruption of their operations and the charging of five Russian nationals. These efforts not only showcase the dedication of global agencies to combating cybercrime but also serve as a stern warning to other potential cyber criminals about the potential consequences of their illicit actions.
