What is LockBit ransomware and how does it work? | royal mail

[ad_1]

LockBit has emerged as the most popular name in ransomware attacks and has now been blamed for an incident that has hit Royal Mail’s international operations. Here’s what we know about LockBit and how it works.

What is ransomware?

Ransomware is a piece of malware, or malware, that is often inserted into an entity’s computer network via a so-called “phishing attempt”. This involves tricking the recipient into downloading malware, usually by clicking a link or attachment contained in an email. A phishing attempt can also involve trying to gain access to their username and password to enter the network, by tricking them into thinking they are logged into the network in question.

The malware then encrypts infected computers, making it impossible to access their content. The rogue actor behind the attack then demands money from the affected entity—usually a company or government organization—in order to unlock or decrypt the computers. According to the US Treasury, US banks and financial institutions alone processed nearly $1.2 billion (£990m) in ransomware payments in 2021.

How does LockBit work?

LockBit is the name given to a specific piece of malware, and the criminal organization behind it also bears this name. The LockBit group also sells this malware to other operators for financial gain, in a model known as ransomware as a service (Raas). On underground forums, the malware is advertised as the “world’s fastest encryption software”.

“We’ve seen a real trend in ransomware gangs running an ‘affiliate model’ where they sell access to this malware on the dark web in exchange for payment, often in cryptocurrency,” says Toby Lewis, Global Head of Threat Analysis at Darktrace. UK cyber security company. “This helps LockBit expand its franchise-like operations.”

Lewis says LockBit operators not only encrypt files but also commit “double-double extortion” in which they steal data and threaten to post it online. Some of the malware’s features include the ability to print ransom demands on affected network printers, a detail reported in the Royal Mail hack, with The Daily Telegraph reporting that the ransomware note stated: “Lockbit Black Ransomware. Your data is being stolen and encrypted.”

LockBit, like most ransomware groups, demands to be paid in cryptocurrency. Bitcoin has historically been the preferred payment method, but according to Sophos, a UK cybersecurity firm, LockBit is clamoring for payment in other digital assets. “Many like LockBit have moved to the monero cryptocurrency instead, due to the increased anonymity it provides,” says Peter Mackenzie, who leads the incident response team at Sophos.

“LockBit ransom demands can range from hundreds of thousands to tens of millions, depending on how much damage is believed to have been done, what kind of data was stolen, and how much they think the victim can afford,” he adds.

Who is behind LockBit?

Most ransomware groups tend to operate from Eastern Europe, former Soviet republics, and Russia itself. “LockBit falls into the same category,” says Lewis. In November, the US Department of Justice charged Mikhail Vasiliev, a dual citizen of Russia and Canada, with alleged participation in the LockBit anti-ransomware campaign. The Justice Department said LockBit was deployed against at least 1,000 victims in the United States and around the world, made at least $100 million in ransom demands and “extracted tens of millions of dollars in actual ransom payments.”

Among the victims of the LockBit attacks is Pendragon, a car dealership in the United Kingdom, which refused to pay a $60 million ransom demand.

According to US cybersecurity firm Trustwave, the LockBit group “dominates the ransomware space” and uses large payments to recruit experienced representatives. It accounted for 44% of ransomware attacks from January to September last year, according to Deep Instinct, an Israeli cybersecurity firm.

The malware was previously known as “.abcd”, after the file extension that was added to encrypted files as they became inaccessible. Ransomware and the groups behind it often undergo name changes in order to avoid law enforcement or company-style rebranding after becoming overly notorious.

“Rebranding is often a common occurrence. This may be to avoid law enforcement or simply relate to marketing,” Lewis says.

Can ransomware attacks be disabled?

this is difficult. Once an attack enters, it is really difficult to stop it. “Your best chance is to stop the attack in the first place,” says Lewis. Clean-ups often include rebuilding systems and networks. “If you have ransomware on your network, it’s really hard to get reassurance any other way than rebuilding systems from scratch.”

Is it illegal to pay the ransom demands?

Last year, the UK’s data watchdog, the Information Commissioner’s Office and the National Cyber ​​Security Centre, all wrote to legal professionals in England and Wales, stressing that law enforcement “discouraged” paying the ransom even though the payments were not usually inappropriate. legal. For example, it is illegal to pay a ransom if the affected entity knows or has reason to suspect that the proceeds will be used to finance terrorism. “Payment incentivizes malicious behavior by malicious actors and does not guarantee decryption of networks or return of stolen data,” the ICO and NCSC letter said.

In the US, the government discourages paying ransoms, but a US Treasury advisory note in 2020 asserted that this was “illustrative only” and “does not have the force of law”.

[ad_2]