Lockbit cybercrime gang says it is back online following global police bust

LONDON — Lockbit, the cybercrime gang that was knocked offline by a comprehensive international police operation earlier this month, says it has restored its servers and is back in business.

The group, notorious on the internet's criminal underground for using malicious software called ransomware to digitally extort its victims, was the target of an unprecedented international law enforcement operation last week which saw its members arrested and indicted.

Lockbit's own website was used by police to taunt its ringleaders, and last Friday (Feb 23) police said its leader "LockbitSupp" was cooperating with law enforcement, without elaborating.

In a lengthy, rambling statement dated Saturday, the group said law enforcement had hacked Lockbit's darkweb site-where the gang leaks data stolen from its victims-using a vulnerability in the PHP programming language, which is widely used to build websites and online applications.

"All other servers with backup blogs that did not have PHP installed are unaffected and will continue to give out data stolen from the attacked companies," said the statement, which was posted in English and Russian on a new version of Lockbit's darkweb site.

A spokesperson for UK's National Crime Agency, which led the international effort to seize Lockbit's operations, said the group "remains completely compromised".

"We recognised Lockbit would likely attempt to regroup and rebuild their systems. However, we have gathered a huge amount of intelligence about them and those associated to them, and our work to target and disrupt them continues," the NCA said on Monday.

The new Lockbit darkweb site showed a gallery of company names, each attached to a countdown clock marking the deadline within which that company was required to pay ransom.

"They want to scare me because they cannot find and eliminate me, I cannot be stopped," said the statement, which was presented as part of a mock-up leak from the FBI.

Last Tuesday the US announced it had charged two Russian nationals with deploying Lockbit ransomware against companies and groups around the world.

Police in Poland made an arrest, and in Ukraine, national and French police arrested a father-son duo they said carried out attacks using Lockbit's malicious software. 

The operation was widely seen by cybersecurity experts as designed to discredit Lockbit's standing amongst its "affiliates" — the criminal groups which use Lockbit's tools to carry out ransomware attacks.

ALSO READ: Ukraine arrests father-son duo in Lockbit cybercrime bust