LockBit, a notorious ransomware gang, has long been shrouded in mystery, with its leader known only as LockBitSupp. This individual, who concealed their real identity and location, was recently targeted by a coalition that included the UK National Crime Agency and FBI. The coalition claimed to know where LockBitSupp lives, his financial worth, and even hinted that he has interacted with law enforcement in some capacity.
In a rather unconventional move, the law enforcement coalition chose to disclose details about LockBitSupp’s lifestyle on a darkweb site that the ransomware gang had commandeered. They mentioned that LockBitSupp drives a Mercedes, with a sarcastic note about the difficulty of finding parts for the vehicle, possibly suggesting that he resides in Russia. This speculation arose as Mercedes-Benz Group AG withdrew from Russia following the invasion of Ukraine.
Following a collaborative effort by investigators from 11 countries, control of LockBit’s infrastructure was seized, leading to the arrest of two members and the indictment of two Russian hackers linked to the gang. In response, the US State Department offered a bounty of up to US$10 million for information leading to the identification of any of the group’s leaders. This marked a significant turn of events after years of LockBit challenging law enforcement agencies.
LockBitSupp, the elusive leader, had previously flaunted their wealth online, offering a reward of US$1 million for simply revealing their name. Despite these provocations, LockBitSupp did not respond to requests for comments regarding the recent law enforcement claims about their identity. According to Jon DiMaggio, chief security strategist at Analyst1, LockBitSupp was skilled at running the criminal operation like a business and maintaining a level of anonymity.
Based on his linguistic style, slang usage, and associations with other Russian hackers, DiMaggio speculated that LockBitSupp was likely of Russian origin. However, he believed that the hacker did not reside in Russia due to public criticisms of the country’s main intelligence agency. LockBit has become one of the most prolific ransomware gangs globally, targeting over 2,000 victims and generating substantial ransom payments.
The group gained prominence through attacks on renowned companies like the Industrial & Commercial Bank of China and Boeing Co, employing tactics of data theft and encryption to extort payments in exchange for decrypting victims’ computers. They also pioneered ransomware as a service, enabling affiliate hackers to carry out attacks using their malicious software and infrastructure.
While the takedown of LockBit was considered a significant blow to the criminal organization, messages from gang representatives indicated plans to rebuild their enterprise. Many members are believed to be in Russia and unlikely to face extradition. National Crime Agency Director General Graeme Biggar emphasized the importance of continued efforts to target and dismantle LockBit and associated individuals.
Biggar acknowledged the damage inflicted on LockBit’s operations and credibility within the criminal hacking community but stressed the ongoing commitment of law enforcement agencies to disrupt their activities. Despite the challenges posed by cybercriminals, efforts to combat ransomware gangs like LockBit remain a top priority for international authorities.
LockBit may attempt to regroup and revive their criminal endeavors, but the persistent pursuit of justice by law enforcement agencies serves as a deterrent. The battle against cybercrime is ongoing, with a focus on dismantling ransomware organizations and holding perpetrators accountable for their actions. The recent actions against LockBit demonstrate the collaborative efforts to combat cyber threats and protect individuals and entities from malicious activities.
