The LockBit Ransomware Gang Is Surprisingly Professional

This article makes LockBit sound like a legitimate organization:

The DDoS attack last weekend that put a temporary stop to leaking Entrust data was seen as an opportunity to explore the triple extortion tactic to apply more pressure on victims to pay a ransom.

LockBitSupp said that the ransomware operator is now looking to add DDoS as an extortion tactic on top of encrypting data and leaking it.

“I am looking for dudosers [DDoSers] in the team, most likely now we will attack targets and provide triple extortion, encryption + date leak + dudos, because I have felt the power of dudos and how it invigorates and makes life more interesting,” LockBitSupp wrote in a post on a hacker forum.

The gang also promised to share over torrent 300GB of data stolen from Entrust so “the whole world will know your secrets.”

LockBit’s spokesperson said that they would share the Entrust data leak privately with anyone that contacts them before making it available over torrent.

They’re expanding: locking people out of their data, publishing it if the victim doesn’t pay, and DDoSing their network as an additional incentive.

Posted on September 7, 2022 at 9:26 AM5 Comments


Clive Robinson September 7, 2022 10:31 AM

@ Bruce, ALL,

They’re expanding: locking people out of their data, publishing it if the victim doesn’t pay,

Let’s move this towards a logical conclusion, as the Ransomware people are attackers, their job as long as they can reach their target is easier than the defenders.

Therefor their “expanding” will take them to the point where no collection of data that is online can be considered even remotely secure from their attacks.

This “has ment” that the owners of data “had” only two end game mitigations,

1, Do not have data on any system that is reachable by an attacker.

2, Do not have the data stored in a form that an attacker can use (ie enctypted)

Note the use of the “past tense” the addition of DDoS etc means that option 2 is nolonger viable.

This effectively means that all “cloud services” and all “remote working” across a network the attackers can reach out on is fully vulnerable to the attackers…

So a swing back to “in office” issolated data centers and workers is in effect the only reliable mitigation against “ransomware” opperators.

I’m sure the big cloud operators will bluster, but at the end of the day they have no actual answer to the problem. That is as long as there is connectivity that both a defender and attacker can share the attacker will win.

I can not see that many organisations wanting to pay[1] for high capacity “Private Leased Lines” direct from their offices to a Cloud Data Center.

So I suspect the pendulum will start to swing back to “In House” data centers again.

But then if you look back to when “cloud” was not much more than a name, some of us came up with a whole list of reasons why it was a bad idea. Since then one by one they’ve been shown to be “valid” as people have fallen foul of them.

[1] Not so true of organisations funded via “tax dollars” like the IC and Mil entities.

Ted September 7, 2022 12:37 PM

Lol. dudos.

“dudos, because I have felt the power of dudos”

But seriously, LockBitSupp is definitely working to make stolen data more reliably available.

John Tillotson September 7, 2022 12:40 PM

I work in a department of an institution where the idea of putting data in the “cloud” (someone else’s computer) is utterly unthinkable at all levels. Other departments can play with cloud, but not my area.

It’s very reassuring to not have to worry about cloud security: Still have to worry about a LOT of security issues with Internet connectivity, firewalls, NIDS/NIPS, zero trust, email, malware, internal threats, yadda yadda yadda, but at least the yoke of cloud security is off my neck.

If a seagull manager comes in with some idea of moving our stuff to cloud, all we need to do is point to info about these ransomware gangs and the sudden silence is golden.

iAPX September 7, 2022 2:19 PM

DDoS are actively used on real-world attacks, not per-se, but as a way to make the security team focus on it while trying to pass protections another way, and also as a way to exhaust the security team at the worst moment (say the lead is in a plane going to vacations), to be less reactive after the end of the DDoS while resting a little.

Except on a big team, you’d better outsource it.

It’s very valuable to have something focusing resources of the security team.

R. Cake September 8, 2022 4:24 AM

So essentially, with multi-channel operations as described here, attackers are applying classical military tactics. Like a deception attack, they serve a real purpose while at the same time obfuscating something that is happening at the same time or about to happen. Indeed they are professionalizing their business.

Leave a comment


Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via

Sidebar photo of Bruce Schneier by Joe MacInnis.