Regardless of being taken down and humiliated by the Nationwide Crime Company (NCA) coordinated Operation Cronos in February 2024, an unknown particular person(s) related to, or claiming to signify, the LockBit ransomware gang has damaged cowl to announce the upcoming launch of a brand new locker malware, LockBit 4.0.
In screengrabs taken from the darkish internet which were extensively circulated on social media up to now day, the supposed cyber felony invited events to “enroll and begin your pentester billionaire journey in 5 minutes with us”, promising them entry to supercars and ladies. On the time of writing, not one of the hyperlinks within the submit direct anyplace, whereas a countdown timer factors to a ‘launch’ date of three February 2025.
Robert Fitzsimons, lead menace intelligence engineer at Searchlight Cyber, mentioned it was laborious to say at this stage what LockBit 4.0 entailed – whether or not the gang was launching a brand new leak website, its outdated one having been seized, or whether or not it has made modifications to its ransomware.
“It’s value noting that LockBit has already been by means of many iterations, its present branding is LockBit 3.0. It is subsequently not stunning that LockBit is updating as soon as once more and – given the model harm inflicted by the regulation enforcement motion Operation Cronos earlier this 12 months – there there may be clearly a motivation for LockBit to shake issues up and re-establish its credentials, maintaining in thoughts that the LockBit 3.0 website was hijacked and defaced by regulation enforcement,” mentioned Fitzsimons.
“There was a lower in LockBit’s sufferer output since Operation Cronos however this submit reveals that it’s nonetheless making an attempt to draw associates and proceed its operations.”
The gang’s sudden announcement comes simply days after it emerged that america authorities is in search of the extradition from Israel of an alleged LockBit operative named as Rotislav Panev to face trial for wire fraud and cyber crime.
Panev was arrested in Haifa in Israel in August – in accordance with Israeli information website Ynet, which was first to report the extradition request, information of his arrest has been restricted to this point with the intention to keep away from tipping off different LockBit associates who could also be positioned outdoors Russia and giving them an opportunity to flee to the relative security afforded them there.
Panev is accused of working as a software program developer for LockBit and will have created the mechanism by which the gang was capable of print ransom notes on printers related to the compromised programs. Panev’s lawyer advised Ynet that he was a pc technician and was by no means conscious of nor concerned in any fraud, extortion or cash laundering.
Laptop Weekly understands an extradition listening to on this case is scheduled for January 2025.
LockBit down however not out?
Since Operation Cronos unfolded in early 2024, the NCA and different businesses that participated within the takedown have been drip feeding extra details about the notorious cyber felony operation.
In Could, the NCA unmasked its chief, LockBitSupp, naming him as Russian nationwide Dmitry Khoroshev and focusing on him with asset freezes and journey bans, concurrent with an indictment within the US that has seen him charged with a complete of 26 counts of fraud, harm to protected computer systems and extortion. Khoroshev stays at giant regardless of a multimillion greenback reward, and LockBitSupp has denied that that is their true id.
Later within the 12 months the NCA named-and-shamed a high-profile LockBit affiliate, Aleksandr Ryzhenkov, aka Beverley, who was additionally a key participant within the Evil Corp operation and served as a henchman to its chief Maksim Yakubets.
Regardless of the obvious success of Operation Cronos, latest historical past has proven that even when regulation enforcement operations might be efficient at disrupting their actions, cyber criminals are remarkably resilient and infrequently capable of rise up their operations once more with relative ease.
Though it isn’t at present potential to establish what the particular person behind LockBit’s announcement is definitely planning, defenders ought to be alert to the opportunity of assault within the coming weeks, and take acceptable anti-ransomware measures wherever potential.
