Well well well, how the turntables have...you get the idea. Lockbit, a notorious ransomware syndicate that's estimated to have extorted more than $120 million of ill-gotten gains from victims worldwide, has been subjected to a successful takedown operation from a group comprising a range of international authorities, including the Swedish police and Europol.
The best part? Rather than simply lock the dark website down, the investigators took the opportunity to do a bit of trolling of their own.
Not content with merely gaining root access to the ransomware group's servers, the authorities, operating under the title «Operation Cronos», decided to have a bit of schadenfreude-inducing fun while they were at it (via Ars Technica). In a series of images displayed on the sites Lockbit previously operated, the investigators not only revealed the extent of the access they had obtained—including control of the main web panel that Lockbit operators used to communicate with their victims—but teased the founder, operating under the name LockbitSupp, in a manner they may well be familiar with.
A page on the main site read «Who is LockbitSupp? The $10m question», complete with a timer counting down the seconds until their identifying information would be posted. This mirrored a common method of extortion used by Lockbit operators to extort large sums of money from victims, in which they taunted their potential prey and gave them an ebbing timeframe in which to pay up.
Not only that, but the images themselves featured filenames that appear to brag about the extent of the operation's success, with some highlights including «this_is_really-bad.png» and «doesnt_look_good.png».
The months-long operation has been regarded as a major victory in the fight against ransomware operators, with 34 servers in the Netherlands, Germany, Finland, France, Sweden, and more taken down once the authorities had had their fun. Two arrests have been made so far, with three international arrest warrants
Read more on pcgamer.com