Lockbit darknet site taken over by law enforcement again

The darknet presence of the online criminal gang Lockbit is once again under the scrutiny of international law enforcement agencies. The cybergang's game of hare and hedgehog with security officials is thus entering the next round. Once again, it is not clear how far this will actually restrict the gang's activities.

The seized darknet website appears in the typical lockbit look, as it did during the first strike in February of this year as part of Operation Cronos, but the investigators have put their own content online. They have announced that they will reveal more information there tomorrow, Tuesday. For example, who is behind the nickname LockBitSupp ("The 10 million dollar question").

Or, what the investigators have discovered so far, personal information on other Lockbit hackers and support for victims of the criminal organization.

Lockbit: International action against criminal gang

The logos of various international law enforcement agencies involved in the current operation can already be found on the subpages. These include the British NCA, the FBI, Europol, the BKA and the LKA Schleswig-Holstein.

The IT security researchers from vx-underground have published a post on X (formerly Twitter), according to which they have spoken to the administrative Lockbit members.

"The Lockbit ransomware group claims law enforcement is lying. They said, 'I don't understand why they're putting on this little show. They're clearly upset that we're continuing to operate.' Lockbit insists that they continue to work and want to 'bring' new victims," writes vx-underground there.

The group had already made similar statements to vx-underground during the first major operation as part of Operation Cronos in February. At that time, the investigators were able to deal the group a severe blow. However, the group has recovered somewhat and appears to be still active, albeit not as dominant as before. They were still able to find and blackmail some victims. The Lockbit employee or employees behind the pseudonym LockBitSupp gave an interview around a month after Operation Cronos. In it, they admitted that some of the partners, the so-called "affiliates", had become afraid and stopped working.

No immediate response has yet been received to inquiries from the BKA and the LKA Schleswig-Holstein. It therefore remains exciting to see what the prosecutors will publish on Tuesday of this week. heise online will report on this.

(dmk)