Law enforcement takes down LockBit site

Over the last two years, LockBit has become one of the most infamous ransomware groups in the world, but law enforcement has begun to move in.

On Monday evening the group’s website changed to show a message saying it is “under control of law enforcement.”

It adds, “The site is now under the control of the National Crime Agency of the UK, working in close cooperation with the FBI and the international law enforcement task force, ‘Operation Cronos’.”

The message also tells visitors to return at 11:30 GMT today for more information. We will update this story at that time.

The NCA, FBA, Europol and other agencies worked together on Operation Cronos.

LockBit is widely thought to be a Russian gang, due to its members mostly speaking the language and its first appearance on Russian language forums in 2019, when it was known as ABCD Ransomware.

The group, although largely avoiding the spotlight, has nonetheless been involved in major attacks. It has hit Boeing, Subway, Royal Mail, the UK’s MoD and even an entire Canadian town.

Law enforcement has been increasingly moving in on ransomware gangs, taking down REvil in 2021, and DoppelPaymer, Qakbot and BlackCat last year.

LockBit, as the most notorious group active today, has been on the radar for some time. Japanese agencies claimed they could decode the gang’s ransomware last year, and Canada detained a suspected affiliate in 2022. Analyst1’s chief security strategist, Jon DiMaggio, even predicted “a rough year” for the group last month.

Jake Moore, global cybersecurity advisor at ESET, noted that while this doesn’t signal the end of LockBit, taking down the website will be a “massive blow” to criminals.

“Although it won’t eradicate the problem, it will disrupt the criminal network potentially saving businesses millions of pounds in targeted activity.”