Lockbit

LockBit 2.0 appeared in 2021[3] and came into the spotlight with their attack on Accenture the same year, where an insider probably helped the group entering the network. LockBit published some of the stolen data from this attack.[4][1]

In January 2022, the electronics group Thales was one of the victims of Lockbit 2.0.[5]

In July 2022, the administrative and management services of La Poste Mobile were attacked.[6]

In September 2022, the group's hackers claimed cyberattacks against 28 organizations, 12 of which involved French organizations.[7] Among them, the Corbeil Essonnes hospital was targeted with a ransom demand of $10 million.[8]

In October 2022, the Lockbit group claimed responsibility for an attack on Pendragon PLC, a group of automotive retailers in the UK. The ransom to decode the files and not reveal their contents is $60 million.[9]

On October 31, 2022, the Lockbit hacker group claims to have attacked the Thales group for the second time. The Lockbit group does not demand a ransom, but displays a countdown ending on November 7, when the data will be released. The hacker group is offering assistance to Thales customers affected by the theft, in order to lodge a complaint against Thales, a group "that has greatly disregarded confidentiality rules".[10] On November 10, 2022, the LockBit 3.0 group publishes the stolen information on the darknet. The 9.5 GB archive contains information on Thales contracts in Italy and Malaysia.[11][12]

In August 2022, German equipment manufacturer Continental suffered a ransomware attack from the LockBit 3.0 group. In November 2022, with no response to its ransom demand, the hacker group published part of the stolen data and offered access to all of it for 50 million euros. Among the hacked data are the private lives of the Group's employees, as well as exchanges with German car manufacturers. Beyond the theft of data, the danger lies in opening the way to industrial espionage. Indeed, among the exchanges with Volkswagen are IT aspects, from automated driving to entertainment, in which Volkswagen wanted Continental to invest.[13]

In November 2022, OEHC - Office d'Équipement Hydraulique de Corse - was the victim of a cyberattack that encrypted the company's computer data. A ransom demand was made by the hacker group, to which OEHC did not respond.[14]

In December 2022, the Lockbit hacker group claimed responsibility for the attack on the California Finance Administration. The governor's office acknowledged being the victim of an attack, without specifying its scale. Lockbit claims to have stolen 246,000 files with a total volume of 75.3 Gb.[15]

In December 2022, the hacker group claimed to have attacked the port of Lisbon. The ransom was set at $1.5 million, to be paid by January 18, 2023.[16]

On December 18, 2022, a group of hackers attacked Toronto's Hospital for Sick Children. After realizing their blunder, the hacker group stopped the attack, apologized and offered a free solution to recover the encrypted files.[17]

In late June 2022, the group launched "LockBit 3.0", the latest variant of their ransomware, after two months of beta testing. Notably, the group introduced a bug bounty program, the first of its kind in the realm of ransomware operations. They invited security researchers to test their softwares to improve their security, offering substantial monetary rewards ranging from $1,000 to $1 million.[1]

In November 2022, the United States Department of Justice announced the arrest of Mikhail Vasiliev, a dual Russian and Canadian national, in connection with the LockBit ransomware campaign. According to the charges, Vasiliev allegedly conspired with others involved in LockBit, a ransomware variant that had been used in over 1,000 attacks globally as of November 2022. According to reports, the operators of LockBit had made at least $100 million in ransom demands and extracted tens of millions in actual ransom payments from victims. The arrest followed a 2.5 year investigation into the LockBit ransomware group by the Department of Justice.[18]

In January 2023, the hacker group claimed to have attacked the French luxury goods company Nuxe[19] and the Elsan group (a French group of private clinics), the hacker group subdued 821 GB of data from the company's headquarters.[20] The same month, Royal Mail's international export services were severely disrupted because of a ransomware attack by lockbit.[21][22]

In February 2023, the group claimed responsibility for the attack on Indigo Books and Music, a chain of Canadian bookstores.[23]

In March 2023, the group claimed responsibility for attacking the BRL group, a water specialist in the Occitania region of France.[24]

On May 16, 2023, the hacker group claimed responsibility for attacking the Hong Kong branch of the Chinese newspaper China Daily. This is the first time the hacker group has attacked a company linked to Chinese power. Just as Lockbit does not attack Russian power, it avoids attacking allies of Russian power.[25]

In May 2023, the hacker group claimed responsibility for the attack on Voyageurs du monde. The hacker group stole some 10,000 identity documents from the company's customer files.[26]

In June 2023, the United States Department of Justice announced criminal charges against Ruslan Magomedovich Astamirov, a Russian national, for his alleged participation in the LockBit ransomware campaign as an affiliate. The charges allege that Astamirov directly executed at least five ransomware attacks against victims and received a portion of ransom payments in bitcoin.[27]

At the end of June 2023, the TSMC group falls victim to a ransomware attack via one of its suppliers. The ransom demanded by LockBit was $70 million.[28]

In July 2023, Lockbit attacked the Port of Nagoya in Japan, which handles 10% of the country's trade. The attack forced a shutdown of container operations.[29]