LockBit’s New Reality Is Out of Control Affiliates

Affiliates of beleaguered ransomware-as-a-service operation LockBit have turned toward Chinese targets, concludes an analysis of data recently leaked from the group’s administrator panel.

See Also: Forrester Top 35 Global Breaches Report: Balance Defense with Defensibility

An unknown hacker in May defaced the LockBit leak site with the message “Don’t do crime. CRIME IS BAD. xoxo from Prague.” The hacker also leaked a database encompassing admin activity from Dec. 18, 2024, to April 29 (see: Hacker Leaks Stolen LockBit Ransomware Operation Database).

Threat intelligence firm Trellix in a Thursday report says it assesses with high confidence that the leaked data is genuine – as other researchers have also concluded, while noting that the leaked data appears to be incomplete.

The Trellix report says the leak shows that LockBit affiliates targeted 156 organizations during that time, a majority of the targets based in China. The leak contained 7.5 megabytes of data, including communications between affiliates and details of Bitcoin wallet addresses.

“LockBit appears willing to operate within Chinese borders and disregard potential political consequences, marking an interesting divergence in their approach,” Trellix wrote.

John Fokker, head of threat intelligence at Trellix, told Information Security Media Group that divining the motive for the LockBit attacks on Chinese targets remains difficult, but may trace to the once high-flying group attempting to remain relevant.

To say LockBit had a difficult 2024 would be an understatement. That February, an international operation led by Britain’s National Crime Agency seized 35 LockBit servers, including the group’s data leak site. Authorities in May revealed the identity of “LockBitSupp,” the public face of LockBit, followed by the arrest of suspected infrastructure provider in October, and then an alleged developer getting busted (see: LockBit and Evil Corp Targeted in Anti-Ransomware Crackdown).

U.K. law enforcement officials, speaking at a recent cybersecurity conference in London, said the LockBit crackdown, codenamed Operation Cronos, disrupted Russian cybercrime forums, causing fragmentation and sowing distrust among hackers (see: LockBit Crackdown Fragmented Russian Cybercrime Groups).

Faced with the challenge of so many cybercrime groups operating from Russia, Western law enforcement agencies have focused on destabilizing the criminal business models and players involved. Thanks to such efforts, “LockBit is no longer sitting on the throne it once had” in terms of market share, while also resulting in “a lack of affiliate oversight” and top-down control, Trellix’s Fokker said.

This may explain the rise in hack attacks under LockBit’s umbrella targeting Chinese organizations. Anastasia Sentsova, a ransomware cybercrime researcher at Analyst1, said these attacks likely trace to the group relying on more inexperienced, low-level affiliates who have disregarded norms more experienced hackers would follow, such as avoiding certain countries as targets.

“Such a surge in low-level affiliates might be explained by the massive pushback from law enforcement, which likely drove away high-profile affiliates due to the damage to the LockBit brand,” said Sentsova.

The law enforcement disruptions led LockBit to putatively open a “lite” affiliate program last December to anyone willing to pay a $777 registration fee. While the LockBit operation claims to have earned $100,000 monthly from registration fees, that amount is “significantly exaggerated,” Trellix said. Bitcoin addresses in the leaked dataset show that fewer than 1% of newly registered affiliates paid the fee – likely resulting in revenue for LockBit of only $10,000 to $11,000 over several months.

The data also reveals that affiliates attacked two Russian government agencies, a major no-no for Russia-based cybercriminals, who depend on Kremlin forbearance. In both cases, Trellix’s report says LockBit apologized and provided decryptors for free – although they didn’t appear to work correctly in either case. Decryptors also don’t eliminate the onerous work of having to wipe and rebuild infected systems, or the time-consuming restoration of data from backups, provided they exist.

Moscow appears to have increasing concerns over the risk posed by the cybercriminal underground rampant inside its borders, and lawmakers have advanced legislation aimed at strengthening domestic cybersecurity and critical national infrastructure. Authorities in December also levied criminal charges against Mikhail Pavlovich Matveev, a LockBit affiliate operative wanted by the U.S. since 2023 for his role in ransomware attacks (see: Russia Indicts Alleged Ransomware Hacker Wanted by the FBI).

“There are several strategic and political reasons why Russia may be moving to strengthen its cybersecurity legislation, especially in the wake of alleged or rumored cyber incidents like the supposed LockBit attack on a defense facility,” said Milivoj Rajić, head of threat intelligence at DynaRisk.

Analysis of the leaked LockBit database showed 18 confirmed payments to cryptocurrency wallets believed to be under the control of affiliates. The payments amounted to roughly $2.3 million. The lite panel appeared to be used by about 70 affiliates during the time covered by the leaks.

The most active affiliate, responsible for nearly half of all leaked negotiations, sported the handle “Christopher” and focused on extorting Taiwanese companies, as well as attacking firms in Greece, the United Arab Emirates and Philippines. His ransom-payment success rate was 57% across 14 victims, perhaps due to a strategy of choosing companies with $10 million or more in revenue, while making relatively modest extortion demands of between $25,000 and $120,000, then offering “discounts” of up to 67%, Trellix found.

With reporting from Information Security Media Group’s Mathew Schwartz in Scotland and David Perera in Northern Virginia.