Ransomware Gang Offers Bug Bounty, Promises Payouts Up to $1 Million

pcmag.com:

In what might be a first, a ransomware gang has launched a bug bounty program designed to reward anyone who submits details on previously unknown website vulnerabilities to the group.  

The program comes from the LockBit, one of the most prolific ransomware gangs on the scene today. On Sunday, malware-repository site VX-Underground noticed(Opens in a new window) the LockBit gang had launched the bug bounty program at a dark web address. 

"We invite all security researchers, ethical and unethical hackers on the planet to participate in our bug bounty program," the hacking group wrote. "The amount of remuneration varies from $1000 to $1 million."

Specifically, LockBit is looking for website vulnerabilities it can manipulate and use to steal data. The group is also interested in learning about bugs in its own ransomware encryption programs and in the Tox messenger and Tor network. 

However, the biggest payout has nothing to do with uncovering software flaws. LockBit is offering $1 million to anyone—including FBI agents—who can “dox” or uncover personal details about the gang’s leader. 

The bug bounty program suggests LockBit is rich enough to buy zero-day exploits, or attacks capable of leveraging unknown software flaws to hack a computer system. Zero-day exploits can be particularly devastating because there’s no software patch a user can install to thwart the attack. In addition, LockBit is promising payouts that can rival the rewards from legitimate bug bounty programs.

LockBit's program is certainly a worrying sign. Its own ransomware site claims the gang has hacked dozens of companies and organizations across the globe. Victims who refuse to pay the ransom have had their internal files leaked on LockBit’s website. 

Acc