[Daily Mail, where America gets its news] A hacker behind the LockBit ransomware site has boasted that its shutdown was because he got 'very lazy after five years swimming in money' as the gang claimed to be operating again a week after being taken down by 'Britain's FBI'.
The shadowy Russian-linked outfit was the target of an unprecedented international law enforcement operation last week which saw some of its members arrested and charged.
But after being taken down by an international coalition led by the National Crime Agency the cybercrime gang says it has restored its services and is back in business.
In a post on the dark web, Lockbit claimed it started to notice problems early in the morning of February 19, but things went back to normal. 'I didn't pay much attention to it, because for 5 years [sic] of swimming in money I became very lazy,' they wrote.
Lockbit, which accounts for up to a quarter of ransomware attacks, has been causing havoc by hacking into computer systems and stealing sensitive data which it then threatens to release unless the victims pay an extortionate ransom.
The Russian-speaking hackers make money by selling their services to fellow crime gangs, with targets including Royal Mail, the NHS, Porton Down and hundreds of companies in the UK and abroad.
Last week, the NCA, FBI, Europol and other policing agencies announced it had seized some of the group's servers, stolen data and cryptocurrency addresses.
Seven suspects have been arrested so far and five people have been charged, including two Russians, Mikhail Vasiliev, who is being held in Canada, and Ruslan Magomedovich Astamirov, who is in the US.
The remaining three - Artur Sungatov, Ivan Kondratyev and Mikhail Pavlovich Matveev - remain at large. The FBI is offering a $10million reward for information leading to the arrest of Matveev, who goes by the alias 'Wazawaka''.
But the cybercriminals have refused to bow down to the authorities and have set up a new website on the dark web.
Releasing a lengthy statement, a member of the group said the FBI was able to seize its servers 'due to my personal negligence and irresponsibility'.
The statement, posted in English and Russian, also said: 'I relaxed and did not update PHP [website software] in time.
'All other servers with backup blogs that did not have PHP installed are unaffected and will continue to give out data stolen from the attacked companies.'
The latest website also posted what it claimed was new hacked data.
A spokesperson for the NCA, which led the international effort to seize Lockbit's operations, said the group 'remains completely compromised'.
'We recognised Lockbit would likely attempt to regroup and rebuild their systems. However, we have gathered a huge amount of intelligence about them and those associated to them, and our work to target and disrupt them continues,' the NCA said on Monday.
The new Lockbit darkweb site showed a gallery of company names, each attached to a countdown clock marking the deadline within which that company was required to pay ransom.
|
