Authorities troll LockBit boss on his commandeered Darkweb site

Days after taking down his organisation, a coalition that includes the UK National Crime Agency and FBI said it knows where LockBitSupp lives, how much he is worth, and claimed he has ‘engaged with law enforcement’. — AP

For years, the identity of the leader of the notorious ransomware gang known as LockBit has remained a mystery. Known as LockBitSupp, the person often communicated in online forums but took pains to conceal his real name and location.

Days after taking down his organisation, days after taking down his organisation, a coalition that includes the UK National Crime Agency and FBI said it knows where LockBitSupp lives, how much he is worth, and claimed he has “engaged with law enforcement”.

The comments, which did not disclose LockBitSupp’s alleged name, had more in common with trolling tactics used by hackers than typically dry statements by law enforcement. In a mocking post Friday on the ransomware’s commandeered darkweb site, the coalition said he drives a Mercedes and that parts for it “may be hard to source”.

That may have been a veiled reference that he lives in Russia, given speculation that LockBitSupp is a Russian national. Mercedes-Benz Group AG pulled out of the country following the invasion of Ukraine.

The development comes after investigators from 11 countries on Tuesday seized control of LockBit’s infrastructure, arrested two members and indicted two Russian hackers allegedly affiliated with the gang. The next day, the US State Department issued a bounty of as much as US$10mil for information leading to the identification of any of the group’s leaders.

It was a reversal of fortune after years of LockBit taunting law enforcement agencies. “I pay exactly 1 million dollars and not a cent less to someone who simply writes my name and surname to me,” LockBitSupp said in April 2022 in an online hacking forum.

LockBitSupp didn’t respond to messages seeking comment on the law enforcement claims about his identity.

Jon DiMaggio, chief security strategist at Analyst1, has researched LockBit and talked to many of its leaders online, including LockBitSupp. “He’s really good at running that operation as a business, which is also why it’s done well, DiMaggio said in a recent interview. “It’s rarely personal.”

LockBitSupp was likely Russian, based on his writing style, the slang he uses and his association with other known Russian hackers, according to DiMaggio. He speculated that the hacker didn’t live in the country because he had publicly criticised Russia’s main intelligence agency, the Federal Security Service, or FSB.

LockBit is the world’s most prolific ransomware gang. Since January 2020, it has targeted more than 2,000 victims, received US$144mil in ransom payments, and made demands totaling hundreds of millions of dollars, according to US authorities.

It gained notoriety after waging disruptive attacks on high profile companies, including the Industrial & Commercial Bank of China Ltd, the UK’s Royal Mail, the financial software firm ION Trading UK and Boeing Co.

LockBit stole internal data and encrypted its victims’ computers, making them unusable. It would then demand payment in exchange for unlocking the computers and not publishing the stolen data. The group’s leaders also pioneered ransomware as a service, using a network of affiliate hackers who carried out attacks using LockBit’s malicious software and infrastructure.

Its takedown was widely viewed as a devastating blow to the criminals. However, the gang’s representatives – several of whom are believed to be at large in Russia and unlikely to be extradited to face charges – have since vowed to rebuild their criminal enterprise, according to online messages reviewed by Bloomberg News.

National Crime Agency Director General Graeme Biggar said in a statement this week that the law enforcement action had damaged LockBit’s capability and also its credibility among the criminal hacking community.

“Our work does not stop here. LockBit may seek to rebuild their criminal enterprise,” Biggar said. “However, we know who they are, and how they operate. We are tenacious and we will not stop in our efforts to target this group and anyone associated with them.” – Bloomberg

Follow us on our official WhatsApp channel for breaking news alerts and key updates!

Next In Tech News

Google Photos is making its smart editing tools available to everyone
Palmsy is your one-person social media with pretend likes
AI is being used to help you eat those leftovers in your fridge
How you address ChatPT can affect your response
Software giant Salesforce in advanced talks to buy Informatica
Coinbase asks to appeal part of case against US SEC
A gaming revolution: From niche industry to pop culture phenomenon
SAG-AFTRA union secures AI protections for artists in deal with major record labels
Roku says more than 500,000 accounts impacted in cyberattack
Exclusive-OpenAI's Altman pitches ChatGPT Enterprise to large firms, including some Microsoft customers

Others Also Read