For several years, LockBit was the largest and most powerful cyber gang in the world.
It attacked thousands of people, breaking
into their computers, encrypting their data, and demanding ransom.
The gang wasn't even doing that itself.
It automated and outsourced the process,
revolutionizing the market and leaving rival gangs in the dust.
But then something went wrong.
Not because the gang was unsuccessful, it's because it had too much success.
Here's the story of LockBit, a criminal organization like no other.
Around two years ago, a man went undercover and infiltrated LockBit.
He became the only person to witness its secrets from inside and report them.
That man is Jon DiMaggio.
I got to know them over time and use fake personas and accounts.
We've had everything from water cooler talk to stuff about their operation.
I've actually had affiliates tell me about attacks before they happen.
The attacks Jon talks about are called ransomware attacks.
They are LockBit's specialty.
The gang infects their victims' computers
with malware that encrypts all the data, turning the device useless.
Then the gang demands ransom.
Basically, it's like infecting someone with an illness and selling the cure.
Many gangs did that before, but from the beginning, LockBit had an edge.
It wasn't just a collection of petty criminals.
It's run like a business, not a criminal operation for the most part.
I think that's why they've had success with drawing in other criminals is because
they always want to talk about, "Hey, what do you want to see next?
What services can we provide?"
LockBit copied business strategies of legitimate companies.
For example, they announced a bug bounty program, which promised a reward for
finding weaknesses in their software, just like a real company would.
At the same time, LockBit did not shy from copying other cyber gangs.
That's how it adapted a model called ransomware as a service.
Instead of attacking the victims
themselves, the gang's members would lease the malicious software to affiliates,
other cyber criminals with less skills but more time to spare.
Even here, LockBit would innovate.
Prior to LockBit, all the ransomware
gangs, the way that the ransomware as a service model works is the ransomware
provider, the gang who controlled the financial aspect of it.
Then they would pay the affiliate.
You were finding the core gang, started ripping off their partners.
You had all these hackers that weren't getting paid.
What LockBit did was said was, "You go take the money, you just pay me my 20%."
LockBit treated their affiliates as
clients and their hacking tool as a product.
The better and easier a product is to use, the more clients you have.
The more clients you have, the higher is your revenue.
It worked wonders for them.
That's because the leader of LockBit is not going to be known for being a hacker.
The leader of LockBit is going to be known for being a strong businessman.
That is, like I said, it's unfortunate,
but that is the recipe that brought them success.
Over the years, they've polished and
perfected their product, adding more and more features.
By 2022, when the third version came
along, the functionality was off the charts.
Would you like your malware to self-destruct after a certain time, infect
other disks, change the victim's wallpaper?
There are options for that.
On top of all, now it does not only encrypt, but also steals the victim's
data, publishing it on the dark web for additional ransom.
They took what used to take an average of
around three weeks to a month to completely breach, expose, get
administrative rights, steal data, and encrypt data that they can now do in days.
It was something I literally could teach my kids to do it.
For a while, LockBit were flying high.
They became the largest and most powerful
malware gang out there, surpassing any competitor by a wide margin.
But then, cracks began showing up.
Remember the bug bounty program LockBit implemented?
Well, the 3.0 had a major bug.
The developer who created LockBit 3.0, he was the same developer that was behind
DarkSide, who did the colonial pipeline hack and BlackMatter ransomware.
So he used a lot of the source code he'd already developed to create this.
Because of that, they also carried over a vulnerability that was found in
BlackMatter, and somebody figured that out.
LockBit had to pay somebody $50,000.
While that was peanuts compared to the
income the gang pulled, the leadership was upset and demanded the developer to cover
the bounty, and the developer was not having any of that.
Well, he was upset with the developer, and
he basically said, "Hey, I'm taking this out of your revenue." The developer was
upset and said, "Hey, I brought over this code and that was time I would have had to
charge you to have developed it from scratch."
So the developer just left.
Despite the gang, he also leaked the
source code of the entire ransomware builder.
Now everybody could find it, modify it, and use it without paying LockBit its 20%.
Copycats started popping up and attacks skyrocketed.
LockBit still had plenty of affiliates, though.
In fact, the number of people who wanted
to use the genuine software was a lot larger than LockBit anticipated,
and that brought problems we have all encountered in our lives.
I kept noticing that when I would go look, and I would actually...
I would go download the data because part
of my job is to validate whether this is a real threat, or if this is something
that's being made up, or if it's fictitious data.
I kept having problems.
At first, I thought it was me.
As I got more, I'll say, smarter people in
the engineering side involved, it became clear that this was not just me.
It was a much bigger problem.
Again, it's just the amount of data that
has to be stored and how quickly it's coming in.
It's just moving it from point A to point D.
When you're talking about massive amounts of data, it's just not easy.
In the dark web, there's so much latency
in those connections as well, let alone just the space for the storage.
Remember, everything's automated.
Affiliate hackers are just clicking the
tab to steal the data, picking their variables, and it's doing it.
When something doesn't go right, it just doesn't work.
One of the key features of the ransomware software was no longer working.
No developer supported the updates of the
software, and the source code for the free version was in the wild.
With all of that, the affiliates started leaving.
At least several of the prominent ones did
so in a very public manner, choosing rival gangs.
That alone wasn't enough to put LockBit down, though.
The numbers were falling, but the empire was still strong.
That is, until one of its rivals, C-L-O-P or CLOP, did the unthinkable.
With this one hack, CLOP left LockBit in
the dust, surpassing its victim count almost twofold, earning millions, and
pulling one of the largest cyberattacks in recent decades.
That's the state of LockBit today.
Competition, betrayal, leaks, and storage problems.
Taken separately, those troubles weren't too serious.
But combined, they brought the gang to the brink.
I see all these problems he's having.
At the same time, at the end of the day, these are all engineering problems.
If it's plausible, he could fix it, and if he does, they could get right back on top.
Is this the downfall of LockBit?
Or will it manage to shrug off the difficulties?
That's the question we will likely see answered in the coming year.
Check out our channel for short documentaries about other cyber gangs.
If you'd like to learn more about CLOP as well, let us know in the comments below.