Trend Micro Uncovers Criminal Insights in Wake of LockBit Disruption

Trend Micro Uncovers Criminal Insights in Wake of LockBit Disruption

Trend Micro Incorporated released comprehensive threat intelligence findings in the wake of the law enforcement-led disruption of the LockBit ransomware group. The unprecedented operation, known as Operation Cronos, marks a significant step forward in the global fight against cyber threats, impacting an entity responsible for an estimated quarter of all ransomware attacks worldwide.

Sharda Tickoo, Country Manager for India & SAARC at Trend Micro: โ€œWe are immensely supportive of the excellent disruptive work done by international Law Enforcement against the Lockbit group, and our ability to provide support with analysis of their planned upcoming version. Getting ahead of these threat actors not only allowed us to pass on intelligence to law enforcement, but also bolstered the defense of our global customer base. As we dissect the aftermath of this takedown, our commitment to enhancing security defense through global threat intelligence is yielding tangible results."

Operation Cronos was different in several ways from many of the typical law enforcement takedowns of criminal groups. More than a mere setback for threat actors, it was a decisive strike that crippled their infrastructure, undercut their financial mechanisms, exposed affiliates, and fractured the trust within their own illicit networks.

This cumulative effort has helped to tarnish LockBit's reputation among its networks and the cybercrime community in general, making it inept in its attempts to regroup. Ringleader "Lockbitsupp" has also been banned from two popular underground forums: XSS and Exploit.

The group has been trying to rebuild New Onion leak sites launched a week after the operation, and Lockbitsupp is actively seeking brokers selling access to .gov, .edu, and .org TLDsโ€”in what appears to be a reprisal for Cronos. 

However, these efforts appear to be failing. Trend's telemetry reveals limited cases of successful attack since the disruption. Although scores of victims have been posted to the new LockBit leak site, the vast majority were reuploaded from previous campaigns or are victims of other threat groups like ALPHV.

The group has also been developing a new version of ransomware, Lockbit-NG-Dev, which Trend has been monitoring closely and provided advanced protections to customers.

Key Achievements of Operation Cronos: 

  • Reputational Damage to LockBit: Given its tarnished reputation, LockBit faces significant challenges in rebuilding its operations and affiliate networks.

  • Strategic Disruption of Infrastructure: The operation's in-depth approach has made LockBit's rebuilding and regrouping process difficult and time-consuming, delaying any potential resurgence.

  • Effective Deterrence: The insight into affiliate activities and the subsequent warnings have likely dismantled any of LockBit's affiliate programs, further weakening its operational capacity.

  • Enhanced Business Security: Trend customers stand to benefit from the operation's outcome and a reduced risk of being targeted by a significant player in the ransomware market.

This disruption underscores Trend's relentless pursuit of anticipating threats and shielding organizations worldwide from the evolving dangers of the cyber landscape. The best way to disrupt common adversaries is by sharing intelligence promptly and efficiently.

๐’๐ญ๐š๐ฒ ๐ข๐ง๐Ÿ๐จ๐ซ๐ฆ๐ž๐ ๐ฐ๐ข๐ญ๐ก ๐จ๐ฎ๐ซ ๐ฅ๐š๐ญ๐ž๐ฌ๐ญ ๐ฎ๐ฉ๐๐š๐ญ๐ž๐ฌ ๐›๐ฒ ๐ฃ๐จ๐ข๐ง๐ข๐ง๐  ๐ญ๐ก๐ž WhatsApp Channel now! ๐Ÿ‘ˆ๐Ÿ“ฒ

๐‘ญ๐’๐’๐’๐’๐’˜ ๐‘ถ๐’–๐’“ ๐‘บ๐’๐’„๐’Š๐’‚๐’ ๐‘ด๐’†๐’…๐’Š๐’‚ ๐‘ท๐’‚๐’ˆ๐’†๐ฌ ๐Ÿ‘‰ FacebookLinkedInTwitterInstagram

Related Stories

No stories found.