Headline
LockBit Ransomware Gang Returns, Taunts FBI and Vows Data Leaks
By Waqas LockBit ransomware gang relaunches operation after law enforcement hacked its servers, threatening to target government entities more now. This is a post from HackRead.com Read the original post: LockBit Ransomware Gang Returns, Taunts FBI and Vows Data Leaks
Despite arrests, infrastructure seizure and international law enforcement efforts, LockBit ransomware has resurfaced, promising robust security and threatening aggressive cyber attacks on UK and USA government sectors.
The LockBit ransomware gang has officially announced its comeback through a detailed message posted on Saturday on its newly created .onion site on the dark web.
The leader of the LockBit ransomware, whose identity is still unknown to authorities, admitted negligence in letting the FBI and the UK’s National Crime Agency control its servers via a PHP attack but promised backups and continued operations.
The new dark web leak site of the ransomware gang is already live and adding new alleged companies as its victims (Screenshot credit: Hackread.com)
The announcement comes only a week after the group was neutralized in Operation Cronos, a multinational law enforcement investigation, reportedly neutralized the ransomware gang.
For your information, on 19 February 2024, as reported by Hackread.com, law enforcement authorities seized LockBit’s infrastructure, including 34 servers that hosted the gang’s data leak website storing stolen data, cryptocurrency addresses, decryption keys, and the affiliate panel causing a major setback to the notorious gang.
The message from the gang’s admin which directly addressed the FBI and the NCA, revealed that servers without PHP installed in backup blogs are unaffected and will continue to release stolen data from targeted companies, even after the FBI hack, and stolen data will be published on the LockBit blog.
The admin claims that Operation Cronos was successful because of their negligence and irresponsibility in “not updating PHP settings on their servers in good time.” They denied Operation Cronos investigators’ claims regarding arresting their two alleged affiliates, the gang donating to a Crimea-based Russian propagandist (Sevastapol Colonel Cassad), and recovering a high number of decryptors.
However, LockBit confirmed the FBI’s claim that its annual income exceeds $100m, based on data from seized cryptocurrency wallets during Operation Cronos. The group has deleted chats containing evidence of ransomware payments, indicating that their revenues exceed US law enforcement estimates. This demonstrates their success despite making mistakes.
The admin wrote that their victim’s admin chat panels server and blog server were running PHP 8.1.2 and were likely hacked using the CVE-2023-3824 vulnerability. LockBit ransomware has updated its PHP server and offering rewards for finding vulnerabilities in its latest version. LockBit has moved its data leak site to a new.onion address and has targeted five victims with countdown timers to expose the stolen data.
LockBit’s message to the FBI and the NCA – Open in a new tab for a clear view (Screenshot credit: Hackread.com)
Regarding why the FBI hacked their infrastructure, the gang stated that their ransomware attack on Fulton County in January irked the authorities for posing the risk of leaking information on Donald Trump court cases and other “interesting things.”
LockBit claims authorities collected over 1,000 decryption keys during Operation Cronos from “unprotected decryptors,” which they defined as low-level malware builds. LockBit plans to upgrade security, manually release decryptors, host affiliate panels on multiple servers, and provide partners with access to different copies.
****RELATED ARTICLES****
- FIN8 Resurfaces with New Sardonic Backdoor
- Hive Ransomware Resurfaces as Hunters International
- FBI Disrupts Chinese State-Backed Volt Typhoon’s KV Botnet
- Mirai botnet resurfaces with MooBot variant to target D-Link devices
- Nasty Mamba ransomware that encrypts entire hard drive resurfaces
Related news
Gentoo Linux Security Advisory 202408-32 - Multiple vulnerabilities have been discovered in PHP, the worst of which can lead to a denial of service. Versions greater than or equal to 8.1.29:8.1 are affected.
Ubuntu Security Notice 6305-3 - USN-6305-2 fixed a vulnerability in PHP. The update caused a regression in Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. This update fix it. It was discovered that PHP incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information.
Debian Linux Security Advisory 5661-1 - Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in secure cookie bypass, XXE attacks or incorrect validation of password hashes.
Debian Linux Security Advisory 5660-1 - Multiple security issues were found in PHP, a widely-used open source general purpose scripting language which could result in secure cookie bypass, XXE attacks or incorrect validation of password hashes.
Ubuntu Security Notice 6305-2 - USN-6305-1 fixed several vulnerabilities in PHP. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, and Ubuntu 20.04 LTS. It was discovered that PHP incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information.
Red Hat Security Advisory 2024-0387-03 - An update for the php:8.1 module is now available for Red Hat Enterprise Linux 9. Issues addressed include a denial of service vulnerability.
Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core). The supported version that is affected is 8.8.60. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise Sun ZFS Storage Appliance. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Sun ZFS Storage Appliance. CVSS 3.1 Base Score 5.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H).
Ubuntu Security Notice 6305-1 - It was discovered that PHP incorrectly handled certain XML files. An attacker could possibly use this issue to expose sensitive information. It was discovered that PHP incorrectly handled certain PHAR files. An attacker could possibly use this issue to cause a crash, expose sensitive information or execute arbitrary code.
In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or RCE.