International Law Enforcement Efforts Hobble Cybercrime Operation

The U.S. Department of Justice joined the United Kingdom and international law enforcement partners in London this week to announce the disruption of the LockBit ransomware group, one of the most active ransomware groups in the world that has targeted over 2,000 victims, received more than $120 million in ransom payments, and made ransom demands totaling hundreds of millions of dollars.County Governments a TargetJefferson County’s IT (Information Technology) Department has made security a top priorityLast year, County Commissioner Mark Schoenrock attended an all-day cybersecurity seminar in Lincoln, presented by the Nebraska Intergovernmental Risk Management Association (NIRMA). Schoenrock gave a report to his fellow commissioners at that time, “We reviewed a number of different hardware and software tools to help us fight off cybersecurity threats, of which they are tremendously increasing. And we learned last week that one of the prime targets is county government for a number of different reasons. One of the prime targets of these people that are out there trying to do bad things.”The Kansas Court system was recently taken down for several weeks due to a ransomware attack, although it is not known if LockBit was behind the attack.Ransomware is one of the most crippling forms of cyberattack. Malware (malicious software) is a computer file or code that can infect a computer system and be used to steal, destroy or alter data. Ransomware is malware that employs encryption to hold computer information for ransom. Once in the system, critical data, applications and files are no longer accessible by the legitimate user. It is called ransomware because a ransom is then demanded by the perpetrators to release the infected systems.The U.K. National Crime Agency’s (NCA) Cyber Division, working in cooperation with the Justice Department, Federal Bureau of Investigation (FBI), and other international law enforcement partners disrupted LockBit’s operations by seizing numerous public-facing websites used by LockBit to connect to the organization’s infrastructure and seizing control of servers used by LockBit administrators, thereby disrupting the ability of LockBit actors to attack and encrypt networks and extort victims by threatening to publish stolen data.“For years, LockBit associates have deployed these kinds of attacks again and again across the United States and around the world. Today, U.S. and U.K. law enforcement are taking away the keys to their criminal operation,” said Attorney General Merrick B. Garland. “And we are going a step further — we have also obtained keys from the seized LockBit infrastructure to help victims decrypt their captured systems and regain access to their data. LockBit is not the first ransomware variant the Justice Department and its international partners have dismantled. It will not be the last.”Additionally, law enforcement has developed decryption capabilities that may enable hundreds of victims around the world to restore systems encrypted using the LockBit ransomware variant. Victims targeted by this malware are encouraged to contact the FBI at https://lockbitvictims.ic3.gov/ to enable law enforcement to determine whether affected systems can be successfully decrypted.“Today’s actions are another down payment on our pledge to continue dismantling the ecosystem fueling cybercrime by prioritizing disruptions and placing victims first,” said Deputy Attorney General Lisa Monaco. “Using all our authorities and working alongside partners in the United Kingdom and around the world, we have now destroyed the online backbone of the LockBit group, one of the world’s most prolific ransomware gangs. But our work does not stop here: together with our partners, we are turning the tables on LockBit — providing decryption keys, unlocking victim data, and pursuing LockBit’s criminal affiliates around the globe.”Two Russian Nationals IndictedThe Justice Department recently unsealed an indictment obtained in the District of New Jersey charging Russian nationals Artur Sungatov and Ivan Kondratyev, also known as Bassterlord, with deploying LockBit against numerous victims throughout the United States, including businesses nationwide in the manufacturing and other industries, as well as victims around the world in the semiconductor and other industries.The Department also unsealed two search warrants issued in the District of New Jersey that authorized the FBI to disrupt multiple U.S.-based servers used by LockBit members in connection with the LockBit disruption. As disclosed by those search warrants, those servers were used by LockBit administrators to host the so-called “StealBit” platform, a criminal tool used by LockBit members to organize and transfer victim data.

Trey Saathoff in Custody

Unseasonably Warm Temps Bring Fire Risk

Related Articles

Fairbury Cemetery Association Ready To Start Phase II Of Road Project

The Cost Of Cleanup

Truancy Declines Since Attendance Support Program Began

David Lottman Is May Veteran Of The Month