CyberSecurity news
FlagThis - #lockbit
|
@www.justice.gov - 71d
The US Department of Justice has unsealed charges against Rostislav Panev, a dual Russian-Israeli national, for his alleged role as a developer within the LockBit ransomware group. Panev is accused of creating software used by the group to disable antivirus programs, spread malware, and generate ransom notes. The charges follow a multi-year investigation into the ransomware group which emerged in 2019, which has targeted over 2,500 victims across 120 countries causing over $500 million in ransom payments. Panev was arrested in Israel in August and is awaiting extradition to the US.
The complaint against Panev claims that he developed and maintained the digital tools used by LockBit to carry out its attacks. Authorities found administrator credentials for LockBit’s infrastructure on his computer and source code for their ransomware. The ransomware group operates on a Ransomware-as-a-Service model, with affiliates executing the attacks after developers like Panev create the necessary tools. While law enforcement disrupted some of LockBit's infrastructure in February, the group managed to relaunch soon after, and many affiliates are still at large. Recommended read:
References :
@cyberinsider.com - 13d
Dutch Police have dismantled the ZServers/XHost bulletproof hosting operation, seizing 127 servers. The takedown follows a year-long investigation into the network, which has been used by cybercriminals to facilitate illegal activities. This includes the spread of malware, botnets, and various cyberattacks.
Earlier this week, authorities in the United States, Australia, and the United Kingdom announced sanctions against the same bulletproof hosting provider for its involvement in cybercrime operations. ZServers was accused of facilitating LockBit ransomware attacks and supporting the cybercriminals' efforts to launder illegally obtained money, according to The Record. The Cybercrime Team Amsterdam will conduct an additional probe of the servers, as the company advertised the possibility for customers to allow criminal acts from its servers while remaining anonymous to law enforcement. Recommended read:
References :
Pierluigi Paganini@Security Affairs - 21h
References:
securityaffairs.com
, The420.in
,
The LockBit ransomware group has targeted newly appointed FBI Director Kash Patel with an alleged "birthday gift" consisting of leaked classified documents. LockBitSupp, the group's alleged leader, posted a message on February 25, 2025, mocking Patel and claiming the group possesses sensitive data that could "destroy" the FBI. This incident raises serious cybersecurity concerns about potential data breaches targeting high-profile individuals and agencies.
The post, found on LockBit's dark leak blog, describes an "archive of classified information" containing over 250 folders of materials dating back to May 29, 2024. This stolen data is presented as a "guide, roadmap, and some friendly advice" to the new FBI Director. The ransomware cartel's actions represent a bold threat, highlighting the increasing sophistication and audacity of cybercriminals targeting government entities and their leadership. Recommended read:
References :
Cybereason Security Services Team@Blog - 28d
The Phorpiex botnet, previously known for spam and cryptocurrency mining, has been observed distributing LockBit Black ransomware, also known as LockBit 3.0. This new attack vector signifies a significant shift in the botnet's operations, now focusing on automated ransomware deployment through compromised websites and phishing emails. The malicious activity begins with phishing emails that contain malicious SCR files. When these files are executed, they establish a connection with a command-and-control server, download the LockBit binary, and execute the ransomware payload to begin file encryption.
Unlike traditional ransomware tactics that involve human operators and attempts at lateral movement within a network, this variant focuses on immediate execution of LockBit, reducing the attack's footprint and making it harder to detect. Phorpiex and LockBit employ various anti-detection strategies, such as deleting URL caches, obfuscating function calls, removing Zone.Identifier metadata, and modifying the Windows registry, all to ensure the ransomware runs automatically. This shift highlights the increasing trend of botnets being used as a tool for ransomware attacks. Recommended read:
References :
|