Trend Micro reveals criminal insights post-disruption of major ransomware group

Trend Micro, a global cybersecurity leader, shares insights post-law enforcement disruption of LockBit ransomware group. Operation Cronos, targeting a quarter of all global ransomware attacks, marks a milestone in cyber threat defense. Notably, the group was linked to a recent data leak involving South Africa’s Government Employees Pension Fund.

Zaheer Ebrahim, Solutions Architect, Middle East and Africa at Trend Micro: “We are immensely supportive of the excellent disruptive work done by international Law Enforcement against the LockBit group, and our ability to provide support with analysis of the planned upcoming version of their new ransomware. Getting ahead of these threat actors not only allowed us to pass on intelligence to law enforcement, but also bolstered the defence of our local customer base. As we dissect the aftermath of this takedown, our commitment to enhancing security defence through global threat intelligence is yielding tangible results.”

Operation Cronos distinguished itself from typical law enforcement takedowns by delivering a decisive blow to the LockBit ransomware group. Beyond merely impeding their operations, it dismantled their infrastructure, disrupted financial mechanisms, exposed affiliates, and fractured trust within their illicit networks.

This coordinated effort tarnished LockBit’s reputation within its networks and the wider cybercrime community, hindering its ability to regroup effectively. The group’s leader, “Lockbitsupp,” faced additional setbacks as they were banned from prominent underground forums.

Despite attempts to rebuild, evidenced by the launch of New Onion leak sites and efforts to procure access to certain top-level domains, such as .gov, .edu, and .org, LockBit’s endeavors seem futile. Trend Micro’s telemetry indicates minimal successful attacks post-disruption, with the majority of victims on the new LockBit leak site either reuploads from previous campaigns or targeted by other threat groups like ALPHV.

Key Achievements of Operation Cronos: 

• Reputational Damage to LockBit: Given its tarnished reputation, LockBit faces significant challenges in rebuilding its operations and affiliate networks.
• Strategic Disruption of Infrastructure: The operation’s in-depth approach has made LockBit’s rebuilding and regrouping process difficult and time-consuming, delaying any potential resurgence.
• Effective Deterrence: The insight into affiliate activities and the subsequent warnings have likely dismantled any of LockBit’s affiliate programs, further weakening its operational capacity.
• Enhanced Business Security: Trend customers stand to benefit from the operation’s outcome and a reduced risk of being targeted by a significant player in the ransomware market.

This disruption underscores Trend’s relentless pursuit of anticipating threats and shielding organisations worldwide from the evolving dangers of the cyber landscape. The best way to disrupt common adversaries is by sharing intelligence promptly and efficiently.