Get all your news in one place.
100’s of premium titles.
One app.
Start reading
TechRadar
TechRadar
Sead Fadilpašić

A whole new generation of LockBit ransomware could be here

Ransomware attack on a computer

Last year, the builder for the LockBit 3.0 ransomware encryptor was leaked, and researchers are now observing hundreds of new variants that spawned directly from that event. 

Cybersecurity researchers from Kaspersky have discovered a significantly altered version of LockBit targeting an unnamed entity. This version was allegedly deployed by a group calling itself NATIONAL HAZARD AGENCY, with the key differences from LockBit 3.0 being in the ransom note.

Usually, LockBit doesn’t specify the amount that is to be paid in exchange for the decryption key and uses a proprietary platform for communication and negotiation with its victims. This group, however, told its victims exactly how much money it expects, and called them to use a Tox service and email to communicate.

Hundreds of variants

While this group made headlines, it’s definitely not the only one using LockBit as a foundation for its own ransomware operations. Kaspersky’s telemetry spotted almost 400 unique LockBit samples, 312 of which were created using the leaked builder. At least 77 samples don’t even mention LockBit in the ransom note, distancing themselves from their relatives, entirely. 

"Many of the detected parameters correspond to the default configuration of the builder, only some contain minor changes," the researchers said. "This indicates the samples were likely developed for urgent needs or possibly by lazy actors."

LockBit is one of the most successful, if not the most successful, ransomware threats out there. This claim was recently made by the US Cybersecurity and Infrastructure Security Agency (CISA), together with its partners the FBI, Multi-State Information Sharing and Analysis Center (MS-ISAC), and the cybersecurity authorities of Australia, Canada, United Kingdom, Germany, France, and New Zealand.

In a security advisory published by these organizations, LockBit stole approximately $91 million just from victims in the United States since 2020. In the last three years, the group successfully compromised roughly 1,700 American organizations. Last year alone, some 16% of all attacks targeted State, Local, and Tribunal (SLTT) governments, MS-ISAC’s data shows. So municipal governments, counties, educational institutions, and public service organizations, were some of the most popular targets.

Via: TheHackerNews

Sign up to read this article
Read news from 100’s of titles, curated specifically for you.
Already a member? Sign in here
Related Stories
Top stories on inkl right now
One subscription that gives you access to news from hundreds of sites
Already a member? Sign in here
Our Picks
Fourteen days free
Download the app
One app. One membership.
100+ trusted global sources.