for several years lock bit was the
largest and most powerful cyber gang in
the world it attacked thousands of
people breaking into their computers
encrypting their data and demanding
Ransom and the Gang wasn't even doing
that itself it automated and outsourced
the process revolutionizing the market
and leaving rival gangs in the dust but
then something went wrong and not
because the gang was unsuccessful it's
because it had too much success so
here's the story of lock bid a criminal
organization like no
[Music]
other around 2 years ago a man went
undercover and infiltrated lock bit he
became the only person to witness its
secrets from inside and report them that
man is John dagio I got to know them
over time and use fake personas and
accounts we've had everything from you
know water cooler talk to you know stuff
about their operation I've actually had
Affiliates tell me about attacks before
they happen the attacks John talks about
are called ransomware attacks they are
lock bits specialty the gang infects
their victim's computers with malware
that encrypts all the data turning the
device useless and then the gang demands
Ransom basically it's like infecting
someone with an illness and selling the
Cure many gangs did that before but from
the beginning Rock bit had an edge it
wasn't just a collection of petty
criminals it's run like a business not a
criminal operation for the most part and
I think that's why they've had success
with with drawing in other criminals is
because you know they always want to
talk about hey what do you want to see
next what services can we provide lock
bit copied business strategies of
legitimate companies for example they
announced a bug Bounty program which
promised a reward for finding weaknesses
in their software just like a real
company would at the same time lock bit
did not shy from copying other cyber
gangs that's how it adapted a model
called ransomware as a service instead
of attacking the victims themselves the
gang's members would lease the malicious
software to Affiliates other cyber
criminals with less skills but more time
to spare and even here lock bit would
innovate prior to lock bit all the
ransomware gangs the way that the RADS
the ransomware a service model worked is
the the ransomware provider at the gang
is who who controlled the financial
aspect of it and then they would pay the
affiliate and you were finding the core
gang started ripping off their partners
and so you had all these hackers that
weren't getting paid so what lock bit
did was said was you go take the money
you just pay me my 20% lock bit treated
their Affiliates as clients and their
hacking tool as a product the better and
easier a product is to use the more
clients you have the more clients you
have the higher is your revenue and it
worked wonders for them and that's
because the leader of lockit is not
going to be known for being a hacker the
leader of lockit is going to be known
for being a strong businessman and that
is UN like I said it's unfortunate but
that that is the recipe that brought
them success over the years they've
polished and perfected their product
adding more and more features by 2022
when the third version came along the
functionality was off the charts would
you like your malware to self-destruct
after a certain time infect other discs
change the victim's wallpaper there are
options for that on top of all now it
does not only encrypt but also steals
the victim's data publishing it on the
dark web for additional ransom they took
what used to take an average of around 3
weeks to a month to completely breach
expose uh get administrative rights
steel data and en cryp data that they
can now do in days it was something I
literally could teach my kids to do it
for a while lock bit were flying high
they became the largest and most
powerful malware gang out there
surpassing any competitor by a wide
margin but then cracks began showing
up remember the bug Bounty program lock
bit implemented well the 3.0 had a major
bug the developer who created lockit 3.0
he was the same developer that was
behind Dark Side who did the colonial
pipeline hack and black matter ran
somewhere so he used a lot of the source
code he'd already developed to create
this because of that there also carried
over a vulnerability in that was found
in black matter and somebody figured
that out lock bit had to pay somebody
$50,000 while that was peanuts compared
to the income the gang pulled the
leadership was upset and demanded the
developer to cover the Bounty and the
developer was not having any of that
well he was upset at the developer and
he basically said hey I'm taking this
out of your Revenue the developer was
upset and said hey I you know brought
over this code and I didn't you know
that was time I would have had to charge
you to have developed it from scratch so
the developer just left and despite the
gang he also leaked the source code of
the entire ransomware Builder now
everybody could find it modify it and
use it without paying lock bit its 20%
copycats started popping up and attacks
skyrocketed lock bits still had plenty
of Affiliates though in fact the number
of people who wanted to use the genuine
software was a lot larger than lock bit
anticipated and that brought problems we
have all encountered in our lives I kept
noticing that when I would go look and I
would actually I would go download the
data CU part of my job is to validate
whether this is a real or threat or if
this is something that's being made up
or if it's fictitious data and I kept
having problems and at first I thought
it was me you know as I got more I'll
say smarter people in the engineering
side involved you know it became clear
that this was not just me it was a much
bigger problem and again it's just the
amount of data that has to be stored and
how quickly it's coming in and it's just
moving it from point A to point B when
you're talking about massive amounts of
data it's just not easy in the dark web
there's so much latency and those
connections as well let alone just the
space for the storage and remember
everything's automated so I hackers are
just clicking the tab to steal the data
picking their variables and it's doing
it so when something doesn't go right it
just doesn't work so one of the key
features of the ransomware software was
no longer working no developers
supported the updates of the software
and the source code for the free version
was in the wild with all of that the
Affiliates started leaving at least
several of the prominent ones did so in
a very public manner choosing rival
gangs that alone wasn't enough to put
lock bit down though the numbers were
falling but the empire was still strong
that is until one of its rivals c0p or
Klo did the unthinkable with this one
hack Klo left lock bit in the dust
surpassing its victim count almost
twofold earning millions and pulling one
of the largest cyber attacks in recent
decades and that's the state of lock bit
today competition betrayal leaks and
storage problems taken separately those
troubles weren't too serious but
combined they brought the gang to the
brink and I see all these problems he's
having at the same time at the end of
the day these are all engineering
problems if he it's plausible he could
fix it and if he does they could get
right back on top so is this the
downfall of lock bit or will it manage
to shrug off the difficulties that's the
question we will likely see answered in
the coming year check out our channel
for short documentaries about other
cyber gangs and if you'd like to learn
more more about Klo as well let us know
in the comments
[Music]
below