"Crime Is Bad": The Fall Of Russian Ransomware Giant LockBit

The sudden fall of a ransomware supplier once described as the world's most harmful cybercrime group has raised questions about Moscow's role in its development and the fate of its founder.
LockBit supplied ransomware to a global network of hackers, who used the services in recent years to attack thousands of targets worldwide and rake in tens of millions of dollars.
Ransomware is a type of malicious software, or malware, that steals data and prevents a user from accessing computer files or networks until a ransom is paid for their return.
LockBit supplied a worldwide network of hackers with the tools and infrastructure to carry out attacks, communicate with victims, store the stolen information and launder cryptocurrencies.
According to the US State Department, between 2020 and early 2024, LockBit ransomware carried out attacks on more than 2,500 victims around the world.
It issued ransom demands worth hundreds of millions of dollars and received at least $150 million in actual ransom payments made in the form of digital currency.
But LockBit was dealt its first devastating blow in February 2024 when the British National Crime Agency (NCA), working with the US FBI and several other nations, announced it had infiltrated the group's network and took control of its services.
Later that year, the NCA announced it had identified LockBit's leader as a Russian named Dmitry Khoroshev (alias LockBitSupp).
The US State Department said it was offering a reward of up to $10 million for information leading to his arrest.
Lockbit, which the NCA said was "once the world's most harmful cybercrime group", sought to adapt by using different sites.
But earlier this year it suffered an even more devastating breach and received a taste of its own medicine.
Its systems were hacked and some of its data stolen in an attack whose origins were mysterious and has, unusually in the cybercrime world, never been claimed.
"Don't do crime. Crime is bad. Xoxo from Prague," said a cryptic message written on the website it had been using.
'Others grow back'
"Lockbit was number one. It was in survival mode and took another hit" with the leak, said Vincent Hinderer, Cyber Threat Intelligence team manager with Orange Cyberdefense.
"Not all members of the group have been arrested. Other, less experienced cybercriminals may join," he added.
However, observations of online chats, negotiations and virtual currency wallets indicate "attacks with small ransoms, and therefore a relatively low return on investment", he said.
A French cyberdefence official, who asked not to be named, said the fall of LockBit in no way represented the end of cybercrime.
"You can draw a parallel with counterterrorism. You cut off one head and others grow back."
The balance of power also shifts fast.
Other groups are replacing LockBit, which analysts said was responsible in 2023 for 44 percent of ransomware attacks worldwide.
"Some groups achieve a dominant position and then fall into disuse because they quit on their own, are challenged or there's a breakdown in trust that causes them to lose their partners," said Hinderer.
"Conti was the leader, then LockBit, then RansomHub. Today, other groups are regaining leadership. Groups that were in the top five or top 10 are rising, while others are falling."
In a strange twist, the LockBit data leak revealed that one of its affiliates had attacked a Russian town of 50,000 inhabitants.
LockBit immediately offered the town decryption software -- an antidote to the poison.
But it did not work, the French official told AFP.
"It was reported to the FSB (security service), who quietly resolved the problem," the official said.
'Complicit'
One thing appears to be clear -- the field is dominated by the Russian-speaking world.
Among the top 10 cybercrime service providers, "there are two Chinese groups", said a senior executive working on cybercrime in the private sector.
"All the others are Russian-speaking, most of them still physically located in Russia or its satellites," said the executive, who also requested anonymity.
It is harder to ascertain what role the Russian state might play -- a question all the more pertinent since Moscow's 2022 invasion of Ukraine.
"We can't say that the groups are sponsored by the Russian state but the impunity they enjoy are enough to make it complicit," argued the French official, pointing to a "porosity" between the groups and the security services.
The whereabouts and status of Khoroshev are also a mystery.
The bounty notice from the US State Department, which said Khoroshev was aged 32, gives his date of birth and passport number but says his height, weight and eye colour are unknown.
His wanted picture shows an intense man with cropped hair and bulging muscular forearms.
"As long as he doesn't leave Russia, he won't be arrested," said the private sector expert. "(But) we're not sure he's alive."
"The Russian state lets the groups do what they want. It's very happy with this form of continuous harassment," he alleged.
In the past, there was some cooperation between Washington and Moscow over cybercrime but all this changed with the Russian invasion of Ukraine.
French expert Damien Bancal cites the case of Sodinokibi, a hacker group also known as REvil, which was dismantled in January 2022.
"The FBI helped the FSB arrest the group. During the arrests, they found gold bars and their mattresses were stuffed with cash," he said.
But since the invasion of Ukraine, "no-one is cooperating with anyone any more".
Asked if the US has questioned Moscow about Khoroshev after the bounty was placed on his head, Kremlin spokesman Dmitry Peskov said: "Unfortunately, I have no information."

Try Our AI Features

Explore what Daily8 AI can do for you:

Learn with AIFact CheckingText to SpeechAI Summary

Related Articles

NDTV

2 hours ago

• NDTV

Bride Killed, Groom Injured After Gunmen Open Fire At Wedding In Southeast France

A 27-year-old bride was killed when gunmen attacked a wedding party in a village in southeastern France, with one of the attackers also dying during the assault, prosecutors said on Sunday. Three other people, including a child, were injured in the attack, which plunged the tiny picturesque village of Goult into shock. According to a source close to the investigation, the violence might be linked to possible drug-related score-settling. At around 4:30 am (0230 GMT) the newlyweds were leaving the party when they were confronted by masked assailants who opened fire. The victims who died are the bride and one of the attackers, who was hit "in return", said Avignon prosecutor Florence Galtier without providing further details. According to earlier information, the attacker was run over by the bride and groom's car. Three people were injured. Of them, the 25-year-old groom and a 13-year-old who was in the couple's car received serious injuries. According to the prosecutor, the attackers, who arrived by car, carried several weapons. They fled on foot after the attack. 'Outraged' According to the police, a total of 28 people were present in the village hall at the time of the attack. The authorities have opened an investigation into murder and attempted murder by an organised gang. Several police cars blocked access to the scene of the tragedy on Sunday morning. "I'm angry. I'm outraged," Goult Mayor Didier Perello told reporters. Perello did not rule out possible score-settling. "I'm ruling nothing out. Absolutely nothing," he said. "We're close to towns, I won't name them, where unfortunately, we've already seen this kind of thing before." Dozens of police and a helicopter have been mobilised to track down the gunmen. According to the mayor, the village hall had been booked by the couple in March. "The village hall had been rented for a wedding by people who don't live in the commune," he added. Guillaume Molinas, 50, said he feared that the tragedy would "give the village a bad name." "The last major incident in the village was 125 years ago," said the owner of a restaurant. The French government has recently vowed to intensify the fight against narcotics and drug-related crime.

Business Standard

2 hours ago

• Business Standard

Over 140 pricked with needles at France's World Music Day celebrations

Celebrations for Fête de la Musique, also known as World Music Day, took a dark turn on Saturday evening as at least 145 people—including teenage girls—were pricked with syringes across France. Millions gathered nationwide for the event, with Paris authorities describing the turnout as drawing 'unprecedented crowds', according to France 24. Social media threats had circulated ahead of the festival, warning of potential attacks targeting women. Following the event, the French interior ministry confirmed that 145 individuals had reported being pricked with needles. Thirteen of these cases were recorded in Paris. Uncertainty around toxic substances Authorities have not yet confirmed whether the cases involve needle spiking using incapacitating substances such as GHB or Rohypnol, which are known to be used in sexual assault cases. 'Some victims were taken to hospital for toxicological tests,' the interior ministry said in a statement. Investigations launched in Paris Paris prosecutors opened three separate investigations after a 15-year-old girl, an 18-year-old male, and a third individual reported being pricked in different parts of the city. All three reported feeling unwell following the incidents. Nationwide, 12 individuals have been arrested in connection with the attacks. In Angoulême, in southwestern France, police took four people into custody for allegedly targeting around 50 victims, according to a police source. Wider unrest and injuries during the festival In total, more than 370 people were detained across the country for various offences committed during the night's celebrations—nearly 90 of them in Paris alone. Fourteen individuals sustained serious injuries during the events, including a 17-year-old who was found with stab wounds to the lower abdomen and was hospitalised. Law enforcement officers were not spared, with 13 officers reported injured while on duty during the festival, the report added.

The Hindu

3 hours ago

• The Hindu

Syria President vows those involved in church attack will face justice

Syrian leader Ahmed al-Sharaa vowed Monday (June 23, 2025) that those involved in a "heinous" suicide attack on a Damascus church would face justice, as he called for unity in the diverse, multi-faith country. The shooting and suicide bombing Sunday at the church in the working-class Dwelaa district of the Syrian capital killed 25 people and wounded 63, the health ministry said. The Islamist authorities who took power after ousting longtime ruler Bashar al-Assad in December said the attacker was affiliated with the Islamic State group, which has not yet claimed the attack. "We promise... that we will work night and day, mobilising all our specialised security agencies, to capture all those who participated in and planned this heinous crime and bring them to justice," interim President Sharaa said in a statement. The attack follows incidents of sectarian violence in recent months, with security one of the greatest challenges for the new authorities. The attack "reminds us of the importance of solidarity, and unity of the government and the people in facing all that threatens our nation's security and stability", Sharaa said. Interior Minister Anas Khattab and intelligence services chief Hussein al-Salameh held an emergency meeting to discuss the investigations, the ministry said in a statement. The attack was the first suicide bombing in a church in Syria since the country's civil war erupted in 2011, according to the Syrian Observatory for Human Rights monitor. It was also the first attack of its kind in the Syrian capital since Assad's ouster. A prayer service at the church is scheduled for 6:00 pm (1500 GMT). Foreign condemnation Since the new authorities took power, the international community has repeatedly urged them to protect minorities and ensure their participation in Syria's transition, particularly after the recent violence. Interior ministry spokesman Noureddine al-Baba said Sunday that "the security of places of worship is a red line, and all efforts will be made to ensure people's freedom to perform their religious rites". IS "aims to sow sectarian division and incite all components of Syrian society to take up arms, seeking to show that the Syrian state is unable to protect its communities and citizens", he told a press conference. The top cleric of Syria's Sunni Muslim majority, Grand Mufti Osama al-Rifai, condemned acts of violence and terrorism in a statement Monday. "We express our complete rejection of targeting places of worship and terrorising believers," he said. Foreign condemnation of the attack continued to roll in on Monday. President Recep Tayyip Erdogan said Turkey would not allow extremists to drag Syria back into chaos and instability, vowing that Turkey would "continue to support the Syrian government's fight against terrorism". Turkey, which is close to the new authorities, has repeatedly offered its operational and military support to fight IS and other militant threats. French President Emmanuel Macron also denounced the "horrible" attack, while the EU said it "stands in solidarity" with Syria in combating ethnic and religious violence. "It is a grave reminder of the need to intensify efforts against the terrorist threat and to ensure the enduring defeat of Daesh and other terrorist organisations," spokesperson Anouar El Anouni said, using another name for IS. Greece's Prime Minister Kyriakos Mitsotakis expressed anger after the attack on the Greek Orthodox Church, calling on the new authorities "to take concrete measures to protect all ethnic and religious minorities". Syria's Christian community has shrunk from around one million before the war to fewer than 300,000 due to waves of displacement and emigration. IS seized large swathes of Syrian and Iraqi territory in the early years of the civil war, declaring a cross-border "caliphate" in 2014. The jihadists were territorially defeated in Syria 2019 but have maintained a presence, particularly in the country's vast desert.