Well, there’s good news and bad news on the security front. Let’s start with the good news.
An international coalition of law enforcement agencies has taken down the Lockbit ransomware group, seizing their servers and arresting individuals in Poland and Ukraine. The group, responsible for over $120 million in ransomware payments, had been operating since 2019. Officials have released decryption keys to help victims recover their data, and more than 200 cryptocurrency accounts linked to the group have been frozen. While some experts warn that Lockbit could resurface under a different name, the takedown is seen as a significant victory in disrupting their operations. UK’s National Crime Agency led the operation and included the FBI.
The operation targeted LockBit, described as the “world’s most harmful cybercrime group,” and resulted in the dismantling of servers and retrieval of over 1,000 decryption keys. LockBit is known for its double extortion tactic and has affected over 2,500 victims worldwide, with illicit profits exceeding $120 million.
The DOJ unsealed indictments against two Russian men alleged to be active members of LockBit. The government says Russian national Artur Sungatov used LockBit ransomware against victims in manufacturing, logistics, insurance, and other companies throughout the United States. Ivan Gennadievich Kondratyev, a.k.a. “Bassterlord,” allegedly deployed LockBit against targets in the United States, Singapore, Taiwan, and Lebanon. Kondratyev is also charged with three criminal counts arising from his alleged use of the Sodinokibi (aka “REvil“) ransomware variant to encrypt data, exfiltrate victim information, and extort a ransom payment from a corporate victim based in Alameda County, California.
With the indictments of Sungatov and Kondratyev, five LockBit affiliates have now been officially charged.
And not the only executive move. The White House has issued an executive order to enhance cybersecurity in maritime ports, requiring stronger cyber defenses and expanding the authorities of the U.S. Coast Guard. The order aims to improve port security, invest $20 billion in port infrastructure, and phase out Chinese-built infrastructure by purchasing trusted cranes. This action follows concerns about China-linked hacking groups infiltrating American critical infrastructure. The maritime transportation system, which accounts for over $5.4 trillion of economic activity, is vital to national security and economic prosperity.
Why do we care?
A huge win for law enforcement. I’m naming names because these aren’t anonymous bots, they’re criminals. It also sends a message to potential cybercriminals about the international legal consequences of crime. Want to push back on ransomware? Collaborate with law enforcement.