The notorious Lockbit ransomware gang is still active and has shared data from five cyberattacks this week, despite a recent global law enforcement crackdown. According to cybersecurity firm Falcon Feeds, Lockbit posted data from five new victims on its dark web site, including two US manufacturing firms, a US infrastructure engineering company, a Canadian oil and energy services company, and a British accounting firm.
However, Brett Callow, a threat analyst at Emsisoft, revealed to PCMag via email that Lockbit is actually presenting old data as new attacks in an attempt to boost their reputation. Callow explained, “None of Lockbit’s new postings seem to relate to new incidents. They’re posting data from old attacks, likely in an effort to rehab their rep and convince affiliates and other business partners that all is well (which it isn’t).”
Despite previous efforts by the US Department of Justice, FBI, UK’s National Crime Agency (NCA), and other agencies to compromise Lockbit’s operations, the ransomware gang quickly bounced back online. They claimed to have preserved their backup servers that didn’t use PHP, which was reportedly the government agencies’ entry point.
While two alleged Lockbit affiliates were arrested in Ukraine last month and the US identified two Russian nationals connected to the group, Lockbit’s activities continue. The supposed anonymous leader of Lockbit stated in an interview with The Record that they are still attacking victims and most members are still deploying ransomware attacks.
Lockbit’s software has been used in attacks against companies like Boeing, dental insurance firms, Subway, and even Apple Silicon Mac computers. The NCA has warned that Lockbit may try to resurrect itself, but they remain committed to dismantling the group.
The saga of Lockbit continues as they persist in their cybercriminal activities despite law enforcement efforts to bring them down.