Paris (AFP) – The sudden fall of a ransomware supplier once described as the world’s most harmful cybercrime group has raised questions about Moscow’s role in its development and the fate of its founder. LockBit supplied ransomware to a global network of hackers, who used the services in recent years to attack thousands of targets worldwide and rake in tens of millions of dollars. Ransomware is a type of malicious software, or malware, that steals data and prevents a user from accessing computer files or networks until a ransom is paid for their return.
LockBit provided a worldwide network of hackers with the tools and infrastructure to carry out attacks, communicate with victims, store stolen information, and launder cryptocurrencies. According to the US State Department, between 2020 and early 2024, LockBit ransomware carried out attacks on more than 2,500 victims around the globe. It issued ransom demands worth hundreds of millions of dollars and received at least $150 million in actual ransom payments made in the form of digital currency.
However, LockBit was dealt its first devastating blow in February 2024 when the British National Crime Agency (NCA), working with the US FBI and several other nations, announced it had infiltrated the group’s network and took control of its services. Later that year, the NCA identified LockBit’s leader as a Russian named Dmitry Khoroshev (alias LockBitSupp). The US State Department said it was offering a reward of up to $10 million for information leading to his arrest.
LockBit, which the NCA described as “once the world’s most harmful cybercrime group,” sought to adapt by using different sites. But earlier this year, it suffered an even more devastating breach and received a taste of its own medicine. Its systems were hacked, and some of its data stolen in an attack whose origins remain mysterious and has, unusually in the cybercrime world, never been claimed. “Don’t do crime. Crime is bad. Xoxo from Prague,” read a cryptic message on the website it had been using.
“Lockbit was number one. It was in survival mode and took another hit” with the leak, said Vincent Hinderer, Cyber Threat Intelligence team manager with Orange Cyberdefense. “Not all members of the group have been arrested. Other, less experienced cybercriminals may join,” he added. However, observations of online chats, negotiations, and virtual currency wallets indicate “attacks with small ransoms, and therefore a relatively low return on investment,” he stated.
A French cyberdefense official, who asked not to be named, noted that the fall of LockBit in no way represented the end of cybercrime. “You can draw a parallel with counterterrorism. You cut off one head and others grow back.” The balance of power also shifts quickly. Other groups are replacing LockBit, which analysts said was responsible for 44 percent of ransomware attacks globally in 2023. “Some groups achieve a dominant position and then fall into disuse because they quit on their own, are challenged, or there’s a breakdown in trust that causes them to lose their partners,” Hinderer explained.
In a strange twist, the LockBit data leak revealed that one of its affiliates had attacked a Russian town of 50,000 inhabitants. LockBit immediately offered the town decryption software—an antidote to the poison—but it did not work, as the French official informed AFP. “It was reported to the FSB (security service), who quietly resolved the problem,” added the official.
One thing appears to be clear—the field is dominated by the Russian-speaking world. Among the top 10 cybercrime service providers, “there are two Chinese groups,” said a senior executive working on cybercrime in the private sector. “All the others are Russian-speaking, most of them still physically located in Russia or its satellites,” noted the executive, who requested anonymity.
It is harder to ascertain the role the Russian state might play—an increasingly pertinent question since Moscow’s 2022 invasion of Ukraine. “We can’t say that the groups are sponsored by the Russian state, but the impunity they enjoy is enough to make it complicit,” argued the French official, pointing to a “porosity” between these groups and the security services.
The whereabouts and status of Khoroshev remain a mystery. The bounty notice from the US State Department stated that Khoroshev, aged 32, had a birth date and passport number, but his height, weight, and eye color are unknown. His wanted picture depicts an intense man with cropped hair and bulging muscular forearms. “As long as he doesn’t leave Russia, he won’t be arrested,” claimed the private sector expert, adding, “But we’re not sure he’s alive.”
“The Russian state lets the groups do what they want. It’s very happy with this form of continuous harassment,” he alleged. In the past, there was some cooperation between Washington and Moscow over cybercrime, but this changed after the Russian invasion of Ukraine. French expert Damien Bancal cites the case of Sodinokibi, also known as REvil, which was dismantled in January 2022. “The FBI helped the FSB arrest the group. During the arrests, they found gold bars and their mattresses were stuffed with cash,” he noted. However, since the invasion of Ukraine, “no one is cooperating with anyone anymore.”
When asked if the US has questioned Moscow about Khoroshev after the bounty was placed on his head, Kremlin spokesman Dmitry Peskov responded: “Unfortunately, I have no information.”
© 2024 AFP
