Lockbit, known for its brazen cyber attacks and extortion tactics was dismantled on 19 February by a coalition of global authorities led by the UK’s National Crime Agency (NCA) called Operation Cronos. 

After the sting on the gang’s server infrastructure, the global authorities took control of data such as source code, decryption tools, and victim data, as well as freezing crypto assets and making two arrests in Poland and Ukraine. 

Now, the cyber-criminal group is declaring to have resurfaced with new servers, and is challenging claims made by law enforcement about the extent of their infiltration. 

According to a letter released by the Lockbit groups administrative staff, the international agencies only managed to obtain decryption keys for a mere 2.5% of the attacks carried out by the ransomware group since its inception.

However, speaking with PCMag, a spokesperson for the NCA insisted that Lockbit’s operations had been “completely compromised.”

“The NCA, working with international partners, successfully infiltrated and took control of Lockbit’s systems, and was able to compromise their entire criminal operation,” they said. 

Despite this, Lockbit’s administrators painted a different picture claiming that Lockbit’s new servers were operational, equipped with updated security measures.

Lockbit also dismissed claims by international authorities regarding the number of decryption keys obtained, asserting that approximately 40,000 keys existed in total. The group vowed to continue its operations unabated, warning that stolen data would be published regardless of payment.

Recommended reading

• Lockbit Disrupted by International Law Enforcement in ‘Operation Cronos’
• LockBit Leaks MoD Contractor Data In “Sophisticated Cyber-Attack”
• NCA: 1 in 5 Kids Engaging in Illegal Online Activity

Some cybersecurity experts, however, see this as no more than reputational damage control. 

“This cyber crime group has stolen more than $100m in ransom payments in the last year alone; they weren’t going to go quietly in the wind after being embarrassed by a contingent of global law enforcement agencies,” said Semperis vice-president for the UK and Ireland, Dan Lattimer, speaking with Computer Weekly.