Feds Unmask LockBit Ransomware Leader as Dmitry Yuryevich Khoroshev

In a major victory for international law enforcement, a collaborative effort by the National Crime Agency (NCA) of the United Kingdom, the US Department of Justice, and Europol have resulted in the unmasking and sanctioning of Dmitry Yuryevich Khoroshev (aka LockBitSupp), a Russian national believed to be the administrator and developer of the notorious LockBit ransomware group.

The latest development occurred a couple of months after international law enforcement authorities carried out Operation Cronos, with the aim of dismantling the notorious LockBit ransomware network.

LockBit has emerged as a significant threat in global cybersecurity, responsible for a wave of crippling ransomware attacks on critical infrastructure including hospitals and businesses worldwide. The group’s ransomware encrypts a victim’s data, rendering it inaccessible, and then demands a hefty ransom payment for decryption.

Some of the gang’s known attacks include the Subway restaurant chain, Boeing, the World’s Largest Bank ICBC, PayBito, and Bangkok Airways. Notably, one of LockBit’s affiliates targeted a children’s hospital, leading the gang to claim they had severed ties with the affiliate. However, authorities have disclosed that this assertion was false, further revealing that the decryption tool provided by the cybercrime syndicate to the hospital failed to function properly.

****Revisiting Operation Cronos****

In February 2024, law enforcement authorities seized multiple dark web domains controlled by the LockBit ransomware gang. Despite no high-profile arrests being made, the group’s anonymous leader declared his return, taunting the FBI and threatening further devastating attacks.

However, on Tuesday, May 7, 2024, authorities utilized one of the seized domains to disclose the alleged identity of the group’s leader, now identified as Dmitry Yuryevich Khoroshev or LockBitSupp. The Department of State also announced a reward of up to $10 million for any information that leads to the apprehension of Khoroshev.

****A Coordinated Approach Takes Down a Cybercriminal****

The NCA led the investigation, working closely with their US and European counterparts. This collaboration proved instrumental in identifying Khoroshev and gathering evidence to link him to LockBit’s operations.

“This is a significant development in our fight against ransomware,” declared a spokesperson for the NCA. “The sanctions will severely restrict Khoroshev’s ability to access funds and hinder LockBit’s criminal activities.”

****Global Sanctions Target LockBit Leader****

Following the identification of Khoroshev, the UK, US, and Australia have imposed sanctions, effectively freezing any assets he may hold within their jurisdictions and prohibiting transactions with him. This financial squeeze aims to disrupt LockBit’s operations and deter future ransomware attacks.

****A Message to Cybercriminals****

The joint action by these international agencies sends a clear message to cybercriminals: there is no haven in cyberspace. Law enforcement cooperation is rapidly evolving, and those responsible for ransomware attacks will be held accountable.

****Importance of Continued Vigilance****

While the unmasking of Khoroshev is a positive step, cybersecurity experts warn that the fight against ransomware is far from over. LockBit is likely to adapt and seek new leadership. Businesses and organizations must remain vigilant and implement cybersecurity measures to protect themselves from future attacks. Here are some key recommendations for staying safe from ransomware:

• Regularly back up your data and store backups securely offline.
• Patch systems promptly to address software vulnerabilities that cybercriminals can exploit.
• Implement multi-factor authentication (MFA) to add an extra layer of security to logins.
• Educate employees about cybersecurity best practices, such as recognizing phishing attempts.

By working together, international law enforcement agencies and the private sector can combat the evolving threat of ransomware and protect the digital world.

1. LockBit blames victim for DDoS attack on its website
2. LockBit Affiliate Sentenced in Canada, Faces Extradition
3. Ukraine Arrests Hackers for Selling 100M Email, Instagram Accounts
4. FBI and AFP Arrest Alleged Developer, Marketer of Firebird/Hive RAT
5. LockBit Posts Dubious Claims of Darktrace Cybersecurity Firm Breach