LockBit Leaks Reveal Drive to Recruit Ransomware Newbies

Ransomware groups continue to find innovative ways to shake down organizations large and small in their pursuit of extortion payoffs.

See Also: Forrester Top 35 Global Breaches Report: Balance Defense with Defensibility

For the past six years, many operations have thrived thanks to the ransomware-as-a-service model. This involves an operator leasing crypto-locking malware to business partners, or affiliates, who download a customized version of the ransomware from a portal and use it to infect victims. For every ransom payment received, the typical agreement is that the affiliate will receive 80%. This approach has allowed attackers to massively scale their operations, while bringing specialist expertise to bear.

For the LockBit ransomware group, one tweak to the RaaS approach has been to debut a “lite” version of its ransomware portal, aimed at recruiting less experienced business partners.

A leak last week of the group’s communications confirmed the new approach, Anastasia Sentsova said, a ransomware cybercrime researcher at Analyst1, in a research report. The leak includes numerous internal communications, as well as messaging between affiliates and victims, all timestamped from December 2024 through April 29 (see: Hacker Leaks Stolen LockBit Ransomware Operation Database).

While LockBit claims to also offer a more advanced panel, Sentsova said that couldn’t be confirmed, although it would square with how the group has traditionally worked.

“Previously, affiliates were required to deposit 1 Bitcoin to a LockBit wallet as an upfront joining fee, which was later used as credit to cover the operator’s 20% share of ransom payments,” she said. “This approach served to establish trust between the affiliate and the operator while also raising the barrier to entry, to deter potential law enforcement agents and researchers from infiltrating the program.”

The introduction of the lite portal followed LockBit being disrupted in early 2024 through Operation Cronos, spearheaded by the U.K.’s National Crime Agency and the FBI. The operation disrupted the groups infrastructure, obtained decryption keys for numerous victims and affiliates’ handles. Law enforcement named and helped securement an indictment against Russian national Dmitry Yuryevich Khoroshev, 32, who stands accused of being the LockBit leader behind the outspoken “LockBitSupp” handle (see: Europol Details Pursuit of LockBit Ransomware Affiliates).

LockBit attempted to brush off the disruption, in part last December when a member of the group – likely LockBitSupp – told threat intelligence research site DeepDarkCTI that he was continuing to refine the operation, including by launching a more easily accessible portal for potential affiliates.

“Now, anyone can access a ransomware panel and start working within five minutes after paying a symbolic fee of $777,” the LockBit representative said. “Those who prove themselves as experienced pentesters will gain access to a more advanced and functional ransomware panel.”

Analyst1’s Sentsova said the leaks suggest the lite panel sported 75 users, of which two – “admin” and “matrix777” – are likely part with the core operation itself, especially because both are linked to the same Tox peer-to-peer instant-messaging ID.

One quirk of the lite panel is that the other 73 users appeared to largely be comprised of relatively inexperienced practitioners. “Several indicators support this conclusion, most notably, the questionable conduct of affiliates during negotiations, ransom demands appear significantly lower than those typically associated with historical LockBit attacks and a consistent pattern of careless on-chain behavior,” Sentsova said. Carless behavior such as affiliates immediately routing ransom payments to accounts at cryptocurrency exchanges – including KuCoin and WhiteBIT – without first attempting to obfuscate the money trail, which she said “suggests a very low level of operational security.”

In the leaked chats, two of the lite panel users introduced themselves in April as being former affiliates of RansomHub – by then no longer operational – while another affiliate, “Christopher,” was especially active, being responsible for 47% of all leaked attacker-victim negotiations, as well as having an unusual and “clear preference for targeting Asia-Pacific countries,” including China, she said.

Even so, Christopher didn’t always appear to know what he was doing, as evidenced by a leaked chat that Sentsova detailed, in which he instructed a victim to pay a ransom using a Chinese cryptocurrency exchange.

“Bro, we are in Taiwan, not China. We hate China,” the victim responded.

In another victim negotiation, the victim pivoted and asked Christopher how to get into ransomware. “We now have open registration in the LockBit panel, but it costs $777,” Christopher replied. When asked what technical skills any would-be applicants might require, Christopher said, “You don’t need it.”

In the leaked victim negotiations, some of the recorded ransoms paid amounted to about $50,000, but others only $12,000 or $15,000. Whether that reflects the victims being relatively small organizations isn’t clear.

For defenders, one unfortunate result of this strategy has been the further “democratization of ransomware” driven by the “increasingly low barrier to entry,” Sentsova said.

“While prevention remains the most critical line of defense, the unfortunate reality is that determined threat actors continue to find ways into victims’ networks,” she said.

Her findings come on the heels of multiple months of the overall volume of ransomware attacks appearing to have risen, based on the claimed victims on data-leak sites. Experts said the reason for the rise may be due to fewer victims paying a ransom, and attackers attempting to compensate.

About 26 fresh victims per day are currently posted across groups’ data-leak sites, although that doesn’t include victims who paid – or are negotiating, British security researcher Kevin Beaumont said in a post to social network Mastodon.

Data-leak sites offer one way to gauge the volume of ransomware attacks, with the caveat that groups never list all victims and regularly lie (see: Ransomware Groups’ Data Leak Blogs Lie: Stop Trusting Them).

Also, many ransomware syndicates and solo operators don’t use data-leak sites. “Most ransomware collectives don’t have portals, and quietly target SMBs without reporting victim names or doing exfil,” Beaumont said. “SMBs are massively under reported as a result.