The FBI has disclosed that it has acquired over 7,000 LockBit decryption keys that individuals can utilize to access encrypted data at no cost, but it is urging previous victims of LockBit ransomware attacks to come forward.

This was announced by the FBI’s Cyber Division Assistant Director, Bryan Vorndran, at the 2024 Boston Conference on Cyber Security.

From our ongoing disruption of LockBit, we now have over 7,000 decryption keys and can help victims reclaim their data and get back online… We are reaching out to known LockBit victims and encouraging anyone who suspects they were a victim to visit our Internet Crime Complaint Center at ic3.gov.

Bryan Vorndran, FBI Cyber Division Assistant Director (Source)

Details About the Seizing and LockBit

The call for action comes after LockBit’s infrastructure was taken down by law authorities in February 2024 as part of a multinational operation known as ‘Operation Cronos’.

During that campaign, the police managed to seize 34 servers containing over 2,500 decryption keys, which helped create a free LockBit 3.0 Black Ransomware decryptor.

The U.K.’s National Crime Agency and the U.S. Justice Department estimate that the gang and its associates have made up to $1 billion in ransom money after 7,000 attacks against organizations worldwide between June 2022 and February 2024, based on their analysis of the information they collected.

Despite efforts from the authorities to shut down the operation, the ransomware gang is still active and has switched to new servers and dark web domains.

They have continued to target victims all around the world and have been releasing large volumes of fresh and old stolen data on the dark web as payback for the recent infrastructure takedown by U.S. and U.K. authorities.

Most recently, the ransomware gang claimed an attack on the Canadian pharmacy chain London Drugs. This happened after another law enforcement operation that doxed the leader of the operation, a 31-year-old Russian national named Dmitry Yuryevich Khoroshev, known online as ‘LockBitSupp’.

If you liked this piece, you can find more on the blog. Follow us on LinkedInTwitterFacebook, and YouTube for more cybersecurity news and topics.

Author Profile
linkedin icon

Cristian is a Content Editor & Creator at Heimdal®, where he developed a deep understanding of the digital threat landscape. His style resonates with both technical and non-technical readers, proof being in his skill of communicating cybersecurity norms effectively, in an easy-to-understand manner.

Leave a Reply

Your email address will not be published. Required fields are marked *

Explore More

[Free & Downloadable] Network Security Policy Template

Ensuring the confidentiality, integrity, and availability of data is not just a best practice but a necessity to protect against breaches and cyber threats. Our Network Security Policy Template provides

Patch Now! CrushFTP Zero-day Lets Attackers Download System Files

CrushFTP urges customers to patch servers with new versions due to discovering zero-day. The CrushFTP zero-day vulnerability is tracked tracked CVE-2024-4040 and enables hackers to escape VFS and download system

Researchers Uncover Fake Antivirus Sites Spreading Malware

Cybersecurity researchers identified several fake antivirus websites used by cybercriminals to distribute malware. These websites closely mimic legitimate antivirus sites but deliver malicious software instead of protection. In mid-April, Trellix’s