The LockBit ransomware group has announced it will pursue more aggressive tactics and is actively recruiting new members after its sites were taken offline for days by distributed denial of service (DDoS) attack.
Announcing the new strategy in a Tweet, the group said targets will now be attacked using a triple extortion model, building on the double extortion method more widely adopted in recent years.
Triple extortion ransomware a relatively new technique that seeks to add the additional threat of a DDoS attack against the victim or their customers, in order to force them to pay. This builds on so-called double extortion ransomware, that sees hackers steal data as well as encrypting it on a victim's machine.
Triple extortion is relatively uncommon, but it was occasionally associated with attacks by the now-shuttered REvil group, which was known to deploy unusual tactics in its campaigns.
If adopted more broadly, it could present the next big development in the cyber security threat landscape facing businesses and other organisations.
In addition to triple extortion, LockBit also said it would begin including unique and randomised payment links in each ransom note, making it difficult for counter-measures like DDoS attacks to impact the threat actor’s payment site.
Why was LockBit targeted by a DDoS attack?
Soon after LockBit published the alleged leaked data on cyber security company Entrust on Friday 19 August, security researchers reported that the LockBit website was being targeted by what appeared to be a DDoS attack.
Security researcher Azim Shukuhi tweeted on Sunday that the attack was still active and the ransomware group was fending off 400 requests a second from more than 1,000 servers.
Shukuhi also said the AlphV/BlackCat ransomware group also sustained a similar attack at the same time, but its website was restored shortly afterwards. It's unknown at this time whether the attacks are linked.
Other than both attacks being believed to be based in, or supportive of, Russia, nothing significant links the LockBit and AlphV/BlackCat ransomware operations.
AlphV/BlackCat is believed to have recruited members from the Russia-linked REvil and DarkSide gangs, and LockBit has previously claimed it is based in the Netherlands, but researchers said that it does not target Russian entities.
Speaking to malware research group VX-Underground, a LockBit support agent accused Entrust of being behind the cyber attack against it.
LockBit supplied a screenshot showing the attack in action with requests appearing to have an aggressively worded note appended to the browser user agent field instructing LockBit to delete Entrust’s data.
If Entrust was behind the attack against LockBit, it would be an unprecedented incident involving a cyber security company conducting an offensive security operation against a ransomware organisation.
At the time of writing, LockBit’s leak site remains unreachable. Entrust has not confirmed if it is or isn’t behind the attack on LockBit.
Entrust announced a cyber attack on the company in late June 2022, but did not specify that it was ransomware in nature.
A LockBit support agent also shared screenshots allegedly showing the negotiations between the ransomware group and Entrust after the initial attack.
Escape the ransomware maze
Conventional endpoint protection tools just aren’t the best defence anymore
According to data in the chat logs, the conversations shared with researcher Soufiane Tahiri date back to 29 June 2022 and the ransom was set at $8 million (£6.8 million) and later lowered to $6.8 million (£5.7 million).
Dominic Alvieri, another security researcher, obtained and tweeted a notice sent by Entrust to its customers, dated 6 July, informing them of the initial attack on June 18.
Alvieri said: “I believe the company wanted to keep it quiet during negotiations and quickly settle after notifying customers. When the cyber incident was exposed they just stopped negotiating”.
Who is behind the DDoS attacks?
It is unclear who is conducting the DDoS attack against LockBit, or the one against AlphV/BlackCat.
LockBit claims Entrust is behind the attack against it, however, it is unlikely that Entrust would ever admit to running offensive security operations, being a legitimate cyber security giant in its own right.
Despite being fairly common in cyber security, DDoS attacks are illegal to operate and it would be highly unlikely for a legitimate company to admit to carrying out its own.
Another theory is that it could be a rival ransomware gang trying to hit LockBit and make it appear as though it came from Entrust, however, this is would not make much economic sense.
Rates for DDoS-as-a-Service operations vary wildly, but according to Kaspersky’s data in 2017, the price for an attack like the one on LockBit - one that uses around 1,000 servers - would cost in the region of $7 (£6) per hour, or upwards of $400 (£340) a day.
