LockBit, known as the most "harmful" ransomware in the world, has been disrupted by cybersecurity officials, with two people arrested, British, US and European officials said on Tuesday.
Britain's National Crime Agency (NCA), said it led an international operation targeting the group that has extracted $120 million (€110 million) from thousands of victims around the world.
The operation resulted in the arrests of two people in Poland and Ukraine and the seizure of 200 cryptocurrency accounts, officials said at a joint news conference. The Justice Department, meanwhile, unsealed indictments against two more people, both Russian nationals.
“LockBit has been locked out"
Authorities said they gained “comprehensive access” to LockBit's systems, taking control of infrastructure and obtaining keys to help victims decrypt their data.
"We have hacked the hackers," said the NCA's director general, Graeme Biggar. “LockBit has been locked out."
Hours before the announcement, the front page of LockBit's dark-web leak site was replaced with the words “this site is now under control of law enforcement,” alongside the flags of the UK, the US and several other nations.
The message said the NCA was “working in close cooperation with the FBI and the international law enforcement task force, Operation Cronos."
"The ongoing operation also involves agencies from Germany, France, Japan, Australia, New Zealand and Canada, among others, including Europol," it said.
LockBit, operating since 2019, has been the most prolific ransomware syndicate two years running. The group accounted for 23% of the nearly 4,000 attacks globally last year in which ransomware gangs posted data stolen from victims to extort payment, according to the cybersecurity firm Palo Alto Networks.
LockBit has been linked to attacks on the UK’s Royal Mail, Britain’s National Health Service, airplane manufacturer Boeing, international law firm Allen & Overy and China’s biggest bank, ICBC.
Ransomware is the costliest and most disruptive form of cybercrime, crippling local governments, court systems, hospitals and schools as well as businesses. It is difficult to combat as most gangs are based in former Soviet states and out of reach of Western justice.
Authorities said they seized servers that the gang used to organise and transfer victim data, and gained access to nearly 1,000 potential decryption tools. They obtained the Lockbit platform's source code and a trove of intelligence on people the gang worked with.
