Resurrected LockBit Dark Web Site Teases Revelations:
An international coalition of police agencies has revived the dark web site of the infamous LockBit ransomware gang, which they had seized earlier this year. The reemergence of the site hints at forthcoming revelations about the group.
New Posts on the Dark Web Site:
The site, formerly owned by LockBit, resurfaced with new posts indicating that authorities are poised to unveil fresh information about the hackers within the next 24 hours. Post titles include “Who is LockBitSupp?”, “What have we learnt”, “More LB hackers exposed”, and “What have we been doing?”
February Law Enforcement Operation:
In February, a coalition including the U.K.’s National Crime Agency, the U.S. FBI, and forces from various other countries announced their infiltration of LockBit’s official site. They seized the site, replacing its content with a press release and other information to alert the hackers of their detection.
Operational Details:
The operation also led to the arrests of two alleged LockBit members in Ukraine and Poland, alongside the takedown of 34 servers across Europe, the U.K., and the U.S., and the confiscation of over 200 cryptocurrency wallets linked to the hackers.
LockBit’s Background:
LockBit emerged in 2019 and has since become one of the most prolific ransomware gangs worldwide, amassing millions in ransom payments. Despite the February takedown, the group resurfaced with a new dark web leak site, updating it with alleged new victims.
Upcoming Announcements:
The posts on the seized site include countdowns ending on Tuesday, May 7, suggesting forthcoming actions against LockBit by law enforcement. One post hints at revealing the identity of LockBitSupp, the group’s leader.
Response from LockBit Staff:
The hacking collective vx-underground reported conversations with LockBit’s administrative staff, who disputed law enforcement claims and expressed defiance against their continued operations.
Uncertainty Surrounding LockBitSupp:
The identity of LockBitSupp remains undisclosed, but an upcoming post on the seized site promises to reveal it on Tuesday, though a similar promise was unfulfilled in the past.
