Current:Home > InvestNotorious ransomware provider LockBit taken over by law enforcement -Golden Summit Finance
Notorious ransomware provider LockBit taken over by law enforcement
View
Date:2025-04-14 17:04:18
Washington — A ransomware service provider that has targeted over 2,000 systems across the globe, including hospitals in the U.S., with demands for hundreds of millions of dollars was taken down Monday, and Russian nationals were charged as part of an international plot to deploy the malicious software, the Justice Department announced Tuesday.
Known as LockBit, the network of cybercriminals targets critical components of manufacturing, healthcare and logistics across the globe, offering its services to hackers who deploy its malware into vulnerable systems and hold them hostage until a ransom is paid. The attackers have so far extorted more than $120 million from their victims, officials said, and their program has evolved into one of the most notorious and active.
As part of this week's operation, the FBI and its law enforcement partners in the United Kingdom seized numerous public-facing platforms where cybercriminals could initiate contact with and join LockBit. Investigators also seized two servers in the U.S. that were used to transfer stolen victim data.
The front page of LockBit's site has been replaced with the words "this site is now under control of law enforcement," alongside the flags of the U.K., the U.S. and several other nations, the Associated Press noted.
According to Attorney General Merrick Garland, the U.S. and its allies went "a step further" by obtaining the "keys" that can unlock attacked computer systems to help victims "regain access to their data," releasing them from having to pay a ransom. The move could help hundreds of victims worldwide.
Two Russian nationals who allegedly used LockBit's ransomware against companies across the U.S. — in Oregon, New York, Florida and Puerto Rico — were also indicted in New Jersey as part of the Justice Department's latest play against the group.
Artur Sungatov and Ivan Kondratyev joined a growing number of defendants accused by federal prosecutors of attacking American institutions as part of the LockBit scheme. A total of five have now been charged, including an individual who allegedly targeted Washington, D.C.'s police force.
LockBit was the most commonly used version of ransomware in 2022, according to a joint cybersecurity advisory published by the FBI and the Cybersecurity and Infrastructure Security Agency last year, and targeted an "array of critical infrastructure sectors, including financial services, food and agriculture, education, energy, government and emergency services, healthcare, manufacturing, and transportation."
The LockBit network was first seen on Russian-speaking cybercrime platforms in 2020 and continued to evolve and grow, targeting computer platforms and various operating systems. By 2022, 16% of ransomware attacks in the U.S. were deployed by the LockBit group, according to the advisory.
Criminals conventionally gain access to vulnerable systems through phishing emails or when users visit an infected site while browsing the internet. And U.S. officials consistently warn users to avoid paying ransoms and instead contact law enforcement.
Federal investigators have recently developed a new approach to combat ransomware attacks that can be both costly to victims and damaging to the normal functioning of society: arming victims with the tools necessary to counter a malware attack.
Similar to the LockBit operation, in July 2022, the FBI toppled an international ransomware group called Hive and collected decryption keys for its penetrated computer networks it had breached to conduct what officials called a "21st-century high-tech cyber stakeout." FBI agents then distributed the keys to the victims whose networks were being ransomed.
And in August, investigators took down a criminal network known as the Qakbot botnet — a grouping of computers infected by a malware program that was used to carry out cyberattacks. Law enforcement gained access to the QakBot infrastructure and "redirected" the cyber activity to servers controlled by U.S. investigators, who were then able to inject the malware with a program that released the victim computer from the botnet, freeing it of the malicious host.
Victims of LockBit attacks are encouraged to contact the FBI for further assistance.
- In:
- Cyberattack
- Ransomware
- Malware
Robert Legare is a CBS News multiplatform reporter and producer covering the Justice Department, federal courts and investigations. He was previously an associate producer for the "CBS Evening News with Norah O'Donnell."
veryGood! (8)
Related
- Dick Vitale announces he is cancer free: 'Santa Claus came early'
- Trump's 17-year-old granddaughter Kai says it was heartbreaking when he was shot
- Bertram Charlton: Compound interest, the egg story
- Atlanta man arrested after driving nearly 3 hours to take down Confederate flag in SC: Officials
- FACT FOCUS: Inspector general’s Jan. 6 report misrepresented as proof of FBI setup
- Cucumbers sold at Walmart stores in Michigan, Ohio and Indiana recalled due to listeria
- U.S. Secret Service director agrees to testify to House lawmakers after Trump assassination attempt
- Appeals court affirms Mississippi’s ban on voting after some felonies, including timber theft
- DeepSeek: Did a little known Chinese startup cause a 'Sputnik moment' for AI?
- Alabama inmate Keith Edmund Gavin to be 3rd inmate executed in state in 2024. What to know
Ranking
- Opinion: Gianni Infantino, FIFA sell souls and 2034 World Cup for Saudi Arabia's billions
- Still empty a year later, Omaha’s new $27M juvenile jail might never open as planned
- Justin Long Admits He S--t the Bed Next to Wife Kate Bosworth in TMI Confession
- Golf's final major is here! How to watch, stream 2024 British Open
- Taylor Swift makes surprise visit to Kansas City children’s hospital
- Pro-war Russian athletes allowed to compete in Paris Olympic games despite ban, group says
- Navy exonerates Black sailors in deadly 1944 port blast. Families say it was long overdue.
- WNBA players’ union head concerned league is being undervalued in new media deal
Recommendation
What were Tom Selleck's juicy final 'Blue Bloods' words in Reagan family
Honolulu officers who handcuffed 10-year-old can be sued for using excessive force, judges rule
Tom Sandoval sues Ariana Madix for invasion of privacy amid Rachel Leviss lawsuit
After crash that killed 6 teens, NTSB chief says people underestimate marijuana’s impact on drivers
Can Bill Belichick turn North Carolina into a winner? At 72, he's chasing one last high
US agency says apps that let workers access paychecks before payday are providing loans
Historic utility AND high fashion. 80-year-old LL Bean staple finds a new audience as a trendy bag
Caitlin Clark, Sabrina Ionescu not in WNBA All-Star 3-point contest