LockBit Returns: Lessons Learned From Operation Cronos

On February 20th, 2024, The National Crime Agency (NCA) and nine other law enforcement agencies seized operations of the infamous ransomware group LockBit in a joint operation named "Operation Cronos" [1]. However, the law enforcement's victory appears to be short-lived and the LockBit leak site came back online after four days. 

In this blog post, we explained why Operation Cronos failed to take down LockBit permanently and how organizations can defend themselves against LockBit attacks.

Operation Cronos: Taking Down LockBit Leak Site

LockBit has become the most notorious ransomware group in the ransomware scene, with 40% attribution of all ransomware attacks in 2023 H2 [2]. LockBit emerged in September 2019 and followed the recent ransomware trends such as Ransomware-as-a-Service (RaaS), double extortion, and Initial Access Brokers (IABs). The group uses data leak websites to publish sensitive or confidential data obtained from their victims during a ransomware attack. These leak sites serve as a means for the attackers to exert pressure on the victims to pay the ransom by threatening to release the compromised information to the public or to other malicious entities. LockBit also uses ransom negotiation sites and affiliate panels to communicate with its affiliate threat actors and victims.

On February 20th, 2024, law enforcement agencies seized LockBit's leak sites, negotiation sites, and affiliate panels in a joint operation known as Operation Cronos. The task force led by NCA took down 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States, and the United Kingdom. The seized infrastructure was used to host malicious tools and store data stolen for extortion. Law enforcement also retrieved decryption keys from seized LockBit infrastructure and released a free decryptor for LockBit 3.0 Black [3]. Operation Cronos revealed that LockBit had 188 affiliates over time and thousands of BTC unspent in seized crypto-wallets. While the operation was a major disruption for the ransomware group, the task force was not able to identify or arrest the threat actor running the LockBit operation, LockBitSupp.

LockBit Returns After 4 Days

On February 24th, 2024, LockBitSupp released a statement and restored the LockBit infrastructure. In the statement, the threat actor speculated that the LockBit servers were infiltrated by law enforcement via vulnerable PHP servers, and Operation Cronos was limited to servers using PHP, meaning that backup servers without PHP were not affected. LockBitSupp confirmed that law enforcement was able to obtain a database, locker stubs, and 1000 decryptors out of 20000 stored on the seized server. 

The threat actor also confirmed the source code of the web panel was seized by law enforcement, and, in response, they divided the panel into many servers unique for verified partners for greater decentralization. 

Lessons Learned from Operation Cronos for Organizations and Individuals

Although it made quite an impact on the ransomware scene, the LockBit operations were expected to return since the threat actors behind the operation are still at large. However, we can learn from Operation Cronos to improve our security posture against future ransomware attacks.

Keep Your Public-facing Applications Up-to-date

In Operation Cronos, law enforcement was able to take down LockBit's infrastructure, presumably using the PHP CVE-2023-3824 Remote Code Execution vulnerability. At the time of operation, this vulnerability was known to the public for more than six months and led to major disruption for LockBit operations. While it was a win for the good guys, there is also a lesson learned for organizations and individuals. The importance of keeping public-facing applications up-to-date cannot be understated.

Updating applications ensures that known vulnerabilities are patched promptly. Software vulnerabilities are regularly discovered by security researchers or malicious actors, and software developers release updates or patches to address these vulnerabilities. Failing to apply these updates leaves applications susceptible to exploitation by cybercriminals, who can exploit these vulnerabilities to gain unauthorized access, steal sensitive data, or disrupt operations.

Mitigate Security Gaps Before Ransomware Threat Actors

Ransomware can pose a significant cyber risk for organizations and individuals. However, it is very much preventable with a robust security posture. Security professionals are advised to run regular security assessments and learn about the security gaps in their posture. Armed with the visibility provided by these assessments, organizations should prioritize and mitigate identified security gaps before ransomware threat actors exploit them. 

Note that sophisticated ransomware attackers quickly incorporate critical severity and newly discovered vulnerabilities into their attack campaigns. Therefore, security teams should mitigate their security gaps without delay for a more resilient security posture against ransomware.

Validate Security Controls Against Ransomware

Ransomware groups are financially motivated and highly skilled cybercriminals, and ransomware attacks are still viable as a business model for these criminals. Even if LockBit operations are completely taken down, there are still many ransomware threat actors with comparable sophistication to LockBit, such as ALPHV, CL0P, and Rhysida.

Since September 2022, CISA has advised organizations to adopt automated security control validation in their cybersecurity advisories to protect against ransomware threat actors [4]. Organizations should continuously validate their security controls against threat behavior mapped to the MITRE ATT&CK framework. 

The recommended methodology is as follows:

1. Select an ATT&CK technique

2. Align your security technologies against the technique

3. Test your technologies against the technique

4. Analyze your detection and prevention technologies' performance

5. Repeat the process for all security technologies

6. Tune your security program

7. Repeat the whole process for other ATT&CK techniques

For more detailed information, please visit our blog post "How to Validate Your Security Controls Against APT Actors at Scale".

How Picus Helps Simulate LockBit Ransomware Attacks?

We also strongly suggest simulating LockBit ransomware attacks to test the effectiveness of your security controls against real-life cyber attacks using the Picus Complete Security Validation Platform. You can also test your defenses against hundreds of other ransomware variants, such as AvosLocker, CL0P, and ALPHV, within minutes with a 14-day free trial of the Picus Platform.

Picus Threat Library includes the following threats for LockBit ransomware:

Picus also provides actionable mitigation content. Picus Mitigation Library includes prevention signatures to address LockBit ransomware and other ransomware attacks in preventive security controls. Currently, Picus Labs validated the following signatures for LockBit ransomware:

Start simulating emerging threats today and get actionable mitigation insights with a  14-day free trial of Picus Complete Security Validation Platform.

References

[1] cms-user, "International investigation disrupts the world's most harmful cyber crime group." Available: https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group. [Accessed: Feb. 27, 2024]

[2] A. Ho, "Ransomware and software vulnerabilities created the most havoc in H2 2023," Acronis, Feb. 07, 2024. Available: https://www.acronis.com/en-us/blog/posts/ransomware-and-software-vulnerabilities-created-the-most-havoc-in-h2-2023/. [Accessed: Feb. 27, 2024]

[3] "Law enforcement disrupt world's biggest ransomware operation," Europol. Available: https://www.europol.europa.eu/media-press/newsroom/news/law-enforcement-disrupt-worlds-biggest-ransomware-operation. [Accessed: Feb. 27, 2024]

[4] "#StopRansomware: ALPHV Blackcat," Cybersecurity and Infrastructure Security Agency CISA. Available: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-353a. [Accessed: Feb. 27, 2024]