LockBit Ransomware Group Building New Locker Before Takedown | #ransomware | #cybercrime

Cybercrime as-a-service
Fraud Management & Cybercrime

Numerous Impediments Remain, Should Administrators Attempt to Reboot Operation

Authorities seized and rewrote the victim listing page on LockBit’s Tor-based data leak site, as seen on Feb. 22, 2023.

The notorious ransomware-as-a-service group LockBit, disrupted by law enforcement this week, has been developing a new version of its crypto-locking malware.

See Also: OnDemand | Understanding Human Behavior: Tackling Retail’s ATO & Fraud Prevention Challenge

So said Tokyo-based cybersecurity firm Trend Micro, which contributed to the international LockBit investigation and takedown spearheaded by Britain’s National Crime Agency.

Prior to LockBit’s infrastructure getting disrupted this week by law enforcement, the group was working on the “next generation” crypto-locking malware, dubbed LockBit-NG-Dev, “which could be an upcoming version the group might consider as a true 4.0 version once complete,” Trend Micro said.

The status of those efforts remains unknown since the NCA and FBI announced Tuesday that via “Operation Cronos,” 10 countries worked jointly to infiltrate and on Monday shut down the infrastructure used by “the world’s most harmful cybercrime group,” backed by arrests and indictments of alleged affiliates and money launderers.

Whether LockBit attempts to reboot, or if its brand might be burned, remains an open question. Regardless, numerous security experts have lauded the disruption, saying it further erodes the group’s criminal brand and will cause major headaches for its operators, contractors and affiliates.

Until the takedown, LockBit remained a major player. LockBit in 2023 and this year – prior to its takedown – received the second highest amount of traceable ransom payments of any ransomware group, said blockchain analytics firm Chainalysis.

Last year, LockBit listed 928 organizations on its data leak site, accounting for 23% of the 3,998 victims listed across all such leak sites, said Palo Alto Networks’ Unit 42. How many more victims the group didn’t list, in part because they paid it a ransom, isn’t clear.

Despite the quantity of non-paying victims highlighted by the group, one of its major impediments was that due to “a number of logistical, technical and reputational problems,” it hadn’t produced a major new version of its crypto-locking malware for affiliates for two years, Trend Micro said.

“With the seeming delay in the ability to get a robust version of LockBit to the market, compounded with continued technical issues, it remains to be seen how long this group will retain their ability to attract top affiliates and hold its position,” Trend Micro said. “In the meantime, it is our hope that LockBit is the next major group to disprove the notion of an organization being too big to fail.”

LockBit once stood apart from other ransomware groups in part due to the speed and sophistication of its crypto-locking malware, which offered “a simplified, point-and-click interface for its ransomware, making it accessible to those with a lower degree of technical skill,” the U.S. Cybersecurity and Infrastructure Security Agency said.

“From a purely technical side, what made LockBit special compared to other competing ransomware packages was that it used to have self-spreading capabilities,” Trend Micro said. “Once a host in the network becomes infected, LockBit is able to search for other nearby targets and to try and infect them as well, a technique that was not common in this kind of malware.”

The group’s public-facing persona LockBitSupp – short for “LockBit Support” – regularly boasted of his outfit’s prowess at the expense of rivals, seeking to burnish the brand and attract fresh affiliates. He promised affiliates would get paid before the core operators, and receive 80% of every ransom their victim paid, or 50% to 70% if LockBit handled the negotiations.

LockBitSupp also backed stunts, such as promising to pay $1,000 to anyone who got tattooed with the group’s logo, and offering a $1 million bounty to anyone able to reveal his true identity.

Security experts said the crypto-locking malware likely attracted all manner of affiliates and sported close ties to Russia. Research released by Mandiant in 2022 suggested Russia’s notorious Evil Corp was using LockBit to evade U.S. sanctions. Chainalysis tracked cryptocurrency donations made by one of LockBit’s administrators “to a pro-Russia self-proclaimed military journalist based in Sevastopol known as Colonel Cassad.”

Multiple Versions

Security experts say LockBit previously released multiple versions of its ransomware:

  • LockBit version 1.0: released in January 2020;

  • LockBit version 2.0: aka “Red,” released in June 2021 together with StealBit, the group’s primary data exfiltration tool;

  • LockBit Linux: released in October 2021 for infecting Linux and VMWare ESXi systems;

  • LockBit version 3.0: aka “Black”, released in March 2022 and leaked six months later by the group’s disgruntled developer, leading to multiple knockoffs;

  • LockBit Green: released in January as being a major new version, which security experts quickly dispelled, finding it to be a rebranded version of a Conti encryptor.

Trend Micro said its teardown of LockBit-NG-Dev revealed that while it has similarities with past versions, “this new version seems to have been written in .NET and possibly compiled using CoreRT, which is different from the usual C/C++ language used for past versions.”

The security firm said the malware offers fast, intermittent and full encryption modes. “Files are usually encrypted under fast mode to speed up encryption – an option commonly favored by affiliates – but it can be configured to perform different modes based on file extensions,” the firm said. LockBit first introduced the intermittent encryption option in version 2.0 of its crypto-locker.

Lagging Updates

LockBit last released a major new version of its ransomware crypto-locker two years ago.

As detailed by ransomware researcher Jon DiMaggio chief security strategist at threat intelligence firm Analyst1, the release of LockBit Green appeared to be a hedge by the group, which was known for releasing a major new version each year. As LockBit’s popularity exploded and the group attracted numerous affiliates, he previously told Information Security Media Group the business, “run by an ego-driven CEO that has massive insecurities,” failed to retain technical talent or successfully scale its infrastructure. As a result, services that affiliates expected, such as new versions of the malware, or automatic leaking of stolen data after a victim refused to pay, didn’t happen.

Further poor management choices by the group’s leadership – likely, LockBitSupp – triggered a falling out with its development talent, leading to a key developer exiting over non-payment for work provided, then leaking source code and publicly denigrating the group, DiMaggio said. The loss of a key developer appeared to leave the group without any ability to rapidly develop a major new version of its malware.

Subsequently, the group appears to have engaged in a smokescreen. Researchers Yelisey Bohuslavskiy and Marley Smith from threat intelligence firm RedSense told ISMG the group’s LockBitSupp persona conducted interviews with journalists and issued provocative statements, especially via Twitter, designed to keep the group in the public eye. At the same time, the ransomware group also signed up numerous low-level affiliates, which the researchers reported were largely ineffective, but still connected the group to active attacks.

Behind the scenes, Smith said LockBit was working with “ghost groups,” meaning contracting with highly skilled hackers, aka pentesters, who were part of other ransomware groups such as Zeon or working independently. Many of this small group of highly skilled pentesters previously worked for the notorious Russian-speaking Conti ransomware group that folded after it publicly backed President Vladimir Putin’s war of conquest against Ukraine, leading to many Conti victims refusing to pay it a ransom.

Conti Talent Bolstered LockBit

Smith said the using ghost groups enabled LockBit to compensate for its own lack of technical talent or skilled affiliates and “to maintain a certain level of mystique and power” needed to bolster the brand and to continue scaring victims into paying.

“While low-tier affiliates were posting on Twitter, the real professionals from Conti were attacking high-profile targets all over the world,” resulting in numerous victims quickly paying up and never getting listed on LockBit’s data leak site, the RedSense researchers said in a new report.

LockBit rebooting remains an unlikely possibility, owing to the loss of face, and the group no longer having the in-house technical they would require to rebuild their infrastructure, they said. “Most likely, LockBit will try to dump old data – the tactic that is used by every group after a takedown, but this won’t bring any results except for media speculation.”

Source link


National Cyber Security