U.S. and worldwide cybersecurity businesses have launched a joint advisory revealing that the LockBit ransomware gang efficiently extorted roughly $91 million by means of 1,700 assaults in opposition to U.S. organizations since 2020.
The Ransomware-as-a-Service (RaaS) operation has emerged as a worldwide risk, boasting the best variety of victims on their information leak web site. LockBit assaults have affected varied sectors, together with monetary providers, healthcare, authorities, schooling, and extra.
The advisory features a record of instruments, an in depth MITRE ATT&CK mapping of techniques employed, and data on vulnerabilities exploited by LockBit. Mitigation measures are additionally offered to help defenders in safeguarding in opposition to LockBit assaults. Bryan Vorndran, Assistant Director of the FBI’s Cyber Division, urges organizations to evaluate the advisory and implement beneficial measures for protection. LockBit ransomware first emerged in 2019 and resurfaced as LockBit 2.0 in 2021, following a ban on ransomware teams on cybercrime boards.
With subsequent variations, LockBit has continued to evolve with modern extortion techniques, cryptocurrency cost choices, and even a ransomware bug bounty program. Notable victims of LockBit assaults embody Continental, the Italian Inside Income Service, the UK Royal Mail, and the Metropolis of Oakland.
Erich Kron, Safety Consciousness Advocate at KnowBe4, shared his insights on LockBit ransomware and the way organizations ought to take steps to guard themselves from ransomware threats:
“LockBit is definitely one of many greatest ransomware threats at the moment in circulation, and the Ransomware-as-a-Service mannequin it makes use of has allowed it to scale to such a degree that its progress will solely proceed until the core builders are shut down. By using associates to hold out the assaults for a majority share of the earnings, the builders can now concentrate on enhancing the ransomware itself and keep away from regulation enforcement actions. As a result of LockBit makes use of associates, the assault vectors will differ, though a lot of them are nonetheless going to start with easy e mail phishing assaults even when the varieties of phishing they use differ barely.
Organizations ought to reference the CISA advisory and take into account the defensive techniques laid on the market. Whatever the explicit pressure of ransomware, educating workers on the way to spot and report phishing emails by stepping them by means of new faculty safety consciousness packages is a really cost-effective option to keep away from the most typical preliminary assault vectors.”
