LockBit hacking group to be 'more aggressive' after falling victim to large-scale DDoS attack
The ransomware group is currently embroiled in a battle after it leaked data belonging to cyber security company Entrust


The LockBit ransomware group has announced it will pursue more aggressive tactics and is actively recruiting new members after its sites were taken offline for days by distributed denial of service (DDoS) attack.
Announcing the new strategy in a Tweet, the group said targets will now be attacked using a triple extortion model, building on the double extortion method more widely adopted in recent years.
Triple extortion ransomware a relatively new technique that seeks to add the additional threat of a DDoS attack against the victim or their customers, in order to force them to pay. This builds on so-called double extortion ransomware, that sees hackers steal data as well as encrypting it on a victim's machine.
Triple extortion is relatively uncommon, but it was occasionally associated with attacks by the now-shuttered REvil group, which was known to deploy unusual tactics in its campaigns.
If adopted more broadly, it could present the next big development in the cyber security threat landscape facing businesses and other organisations.
In addition to triple extortion, LockBit also said it would begin including unique and randomised payment links in each ransom note, making it difficult for counter-measures like DDoS attacks to impact the threat actor’s payment site.
Why was LockBit targeted by a DDoS attack?
Soon after LockBit published the alleged leaked data on cyber security company Entrust on Friday 19 August, security researchers reported that the LockBit website was being targeted by what appeared to be a DDoS attack.
Get the ITPro daily newsletter
Sign up today and you will receive a free copy of our Future Focus 2025 report - the leading guidance on AI, cybersecurity and other IT challenges as per 700+ senior executives
Security researcher Azim Shukuhi tweeted on Sunday that the attack was still active and the ransomware group was fending off 400 requests a second from more than 1,000 servers.
Shukuhi also said the AlphV/BlackCat ransomware group also sustained a similar attack at the same time, but its website was restored shortly afterwards. It's unknown at this time whether the attacks are linked.
Other than both attacks being believed to be based in, or supportive of, Russia, nothing significant links the LockBit and AlphV/BlackCat ransomware operations.
AlphV/BlackCat is believed to have recruited members from the Russia-linked REvil and DarkSide gangs, and LockBit has previously claimed it is based in the Netherlands, but researchers said that it does not target Russian entities.
Speaking to malware research group VX-Underground, a LockBit support agent accused Entrust of being behind the cyber attack against it.
LockBit supplied a screenshot showing the attack in action with requests appearing to have an aggressively worded note appended to the browser user agent field instructing LockBit to delete Entrust’s data.
If Entrust was behind the attack against LockBit, it would be an unprecedented incident involving a cyber security company conducting an offensive security operation against a ransomware organisation.
At the time of writing, LockBit’s leak site remains unreachable. Entrust has not confirmed if it is or isn’t behind the attack on LockBit.
Entrust announced a cyber attack on the company in late June 2022, but did not specify that it was ransomware in nature.
A LockBit support agent also shared screenshots allegedly showing the negotiations between the ransomware group and Entrust after the initial attack.
RELATED RESOURCE
Escape the ransomware maze
Conventional endpoint protection tools just aren’t the best defence anymore
According to data in the chat logs, the conversations shared with researcher Soufiane Tahiri date back to 29 June 2022 and the ransom was set at $8 million (£6.8 million) and later lowered to $6.8 million (£5.7 million).
Dominic Alvieri, another security researcher, obtained and tweeted a notice sent by Entrust to its customers, dated 6 July, informing them of the initial attack on June 18.
Alvieri said: “I believe the company wanted to keep it quiet during negotiations and quickly settle after notifying customers. When the cyber incident was exposed they just stopped negotiating”.
Who is behind the DDoS attacks?
It is unclear who is conducting the DDoS attack against LockBit, or the one against AlphV/BlackCat.
LockBit claims Entrust is behind the attack against it, however, it is unlikely that Entrust would ever admit to running offensive security operations, being a legitimate cyber security giant in its own right.
Despite being fairly common in cyber security, DDoS attacks are illegal to operate and it would be highly unlikely for a legitimate company to admit to carrying out its own.
Another theory is that it could be a rival ransomware gang trying to hit LockBit and make it appear as though it came from Entrust, however, this is would not make much economic sense.
Rates for DDoS-as-a-Service operations vary wildly, but according to Kaspersky’s data in 2017, the price for an attack like the one on LockBit - one that uses around 1,000 servers - would cost in the region of $7 (£6) per hour, or upwards of $400 (£340) a day.

Connor Jones has been at the forefront of global cyber security news coverage for the past few years, breaking developments on major stories such as LockBit’s ransomware attack on Royal Mail International, and many others. He has also made sporadic appearances on the ITPro Podcast discussing topics from home desk setups all the way to hacking systems using prosthetic limbs. He has a master’s degree in Magazine Journalism from the University of Sheffield, and has previously written for the likes of Red Bull Esports and UNILAD tech during his career that started in 2015.
-
Bigger salaries, more burnout: Is the CISO role in crisis?
In-depth CISOs are more stressed than ever before – but why is this and what can be done?
By Kate O'Flaherty Published
-
Cheap cyber crime kits can be bought on the dark web for less than $25
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
By Emma Woollacott Published
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackers
News Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
By Emma Woollacott Published
-
Healthcare systems are rife with exploits — and ransomware gangs have noticed
News Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
By Nicole Kobie Published
-
Alleged LockBit developer extradited to the US
News A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
By Emma Woollacott Published
-
February was the worst month on record for ransomware attacks – and one threat group had a field day
News February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
By Emma Woollacott Published
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impacted
News The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
By Solomon Klappholz Published
-
Warning issued over prolific 'Ghost' ransomware group
News The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
By Solomon Klappholz Published
-
The Zservers takedown is another big win for law enforcement
News LockBit has been dealt another blow by law enforcement after Dutch police took 127 of its servers offline
By Solomon Klappholz Published
-
There’s a new ransomware player on the scene: the ‘BlackLock’ group has become one of the most prolific operators in the cyber crime industry – and researchers warn it’s only going to get worse for potential victims
News Security experts have warned the BlackLock group could become the most active ransomware operator in 2025
By Solomon Klappholz Published