Lockbit & LockBit3 Help

Experiencing Ransomware or Cyber Breach?

Response time is everything when you are under attack. If you have been breached or have an urgent matter, contact us immediately.
Lockbit is a Russian backed ransomware group that first emerged in 2019 and has since become one of the fastest growing ransomware groups in the world.

An infection with LockBit, (or any ransomware) is characterised by your systems displaying a notice like the above with the perpetrator, a specialist cybercrime group, holding your infected systems and stolen data hostage until you pay a ransom. The ransom is typically demanded in cryptocurrency such as bitcoin.

Why you must not interfere with your ransomware environment

If you discover a physical break-in at your offices, your first thought would be to call the police; touch nothing and let them search for clues to the perpetrator. Then, work out how to get your business operations back up and running.

A cyber-attack requires the same logic. Your environment is a CRIME SCENE. It's imperative for the environment to remain untouched so that a forensic investigation can be carried out.

This is not a job for your IT team or MSP. There are digital forensic specialists available 24/7 who can assist you, just like in a physical crime.

LockBit PC Screen
If your systems display a message like above, they have been compromised by a LockBit attack.
YOU MUST NOT ATTEMPT TO TOUCH, RESTORE OR OVERWRITE THE DATA

Who is LockBit and what does it do?

LockBit first emerged in 2019 under the moniker ABCD Ransomware and is believed to have roots in Russia. It has since undergone several evolutions with Lockbit 3.0 being the latest variant. Lockbit 3.0 provides Ransomware as a service (RaaS) with the criminal group receiving payment from affiliates to launch cyber-attacks using their distinct brand of malware called “StealBit”. This malware automates the transfer of data to the intruder and is known for its rapid and efficient encryption capabilities. In 2022 they were the most deployed ransomware strain in the UK and continue to be the most prolific ransom group globally.

The LockBit group's modus operandi looks to leverage vulnerable Remote Desktop Protocol (RDP) servers and/or obtain compromised credentials from affiliates. They are known to employ common attack vectors such as phishing emails with harmful links, as a way of gaining initial access. In addition to this, they have been found to employ brute-force methods on weak RDP or VPN passwords and exploit vulnerabilities.

How Does Lockbit Attack?

Using double extortion tactics to infiltrate a system, thr group executes its ransomware executes its ransomware through command-line arguments, scheduled tasks, and/or PowerShell scripts. The malware methodically collects credentials, disables security products, and skilfully evades defences. Before advancing to the final stage of file encryption, it meticulously clears logs, often operating discreetly for days or even weeks before the breach is detected.

How old is Lockbit and how many attacks have there been?

Similar to legitimate software companies, Lockbit continuously develops and releases new malware variants, with LockBit 3.0 being the latest ransomware iteration.

LockBit's impact and tactics demonstrate their adaptability. To date, lockbit has amassed 1867 victims.

UK Data 2024
Most Recent Lockbit 3 Attacks
TitleAvailableLast visitfqdnScreenshots
LockBit BLOGYes2024-12-06 07:48:45.522839http://lockbit3753ekiocyo5epmpy6klmejchjtzddoekjlnt6mu3qh4de2id.onion
Humanity checkYes2024-12-06 07:48:30.307431http://lockbitqfj7mmhrfa7lznj47ogknqanskj7hyk2vistn2ju5ufrhbpyd.onion
Humanity checkYes2024-12-06 07:48:16.430658http://lockbitkwkmhfb2zr3ngduaa6sd6munslzkbtqhn5ifmwqml4sl7znad.onion

Solace Cyber’s track record includes hundreds of successful response recoveries, providing Digital Forensic Incident Response services, 24x7x365.

“Cyber risks, such as IT outages, ransomware attacks or data breaches, rank as the most important risk globally (34% of responses) for the second year in succession – the first time this has occurred.” Ref Allianz Risk Barometer 2023 - Rank 1: Cyber incidents

Post Breach Actions

Your NCSC-approved supplier is a specialist Crime Scene Investigator who helps you get back to full operation faster. They will:
  • Isolate and preserve your environment for forensic investigation.
  • Identify where the data has been duplicated and issue a legal takedown order.
  • Identify your data, application and systems restore points. These might be at different points in time and will need to be carefully restored and reconstructed in a pristine environment.
  • Liase with your business insurance company and if needed, with the Police.
  • Advise you on notifying your customers of your situation.
  • Rebuild your systems, restore your data and get you back to full operation.
Note: This process can take between 2 weeks – 2 months.

Ransom Groups Stats by Industry

Who is Solace Cyber and what experience do they have in recovering from LockBit ransomware attacks?

Solace Global was founded in 2010 as global experts in risk management and security, offering services such as Travel, Crisis, and Offshore Risk Management. With a 24/7 Security Operations Centre and an in-house intelligence team providing daily and weekly reports, Solace Global is accredited to ISO 27001, 14001, 45001, and 9001 standards.

Solace Cyber was established in 2021, specialising in Cyber breaches, particularly Digital Forensics and Incident Response, Ransomware, Risk Management, and Information Security, along with Managed Security Services. The leadership team collectively possess over 20 years of experience in the IT and security industry.

Solace Cyber is accredited to ISO 27001 and in 2022 gained the prestigious Cyber Incident Response (Level 2) accreditation with the National Cyber Security Centre in 2022. This accreditation represents the UK’s highest cyber security standards, providing top-tier incident response support and recovery.

Solace Cyber Stats

s

Successful breach recoveries

Users recovered in largest ransomware case
We have NEVER paid a ransom
Designed automation tools to reduce costs

%+

Success in our insurance claims

Experiencing Ransomware or Cyber Breach?

Response time is everything when you are under attack. If you have been breached or have an urgent matter, contact us immediately.

Why should I trust Solace Cyber to do this work rather than my IT team?

A forensic analysis needs to be meticulous and a clean restore and recovery requires a wealth of experience not normally available in an in-house team who must provide a broader range of IT support skills:

  • Internal IT teams don’t have the necessary skill set to resolve security encryption issues themselves.
  • Internal teams are pressured to restore business operations and may recover before forensic analysis even begins, potentially destroying the crime scene before completion.
  • IT teams may recover to the same position with indicators of compromise ready to do it again… which can lead to another breach.
  • In 2022, there were not enough adequately qualified people in the job market to meet the CSIRT* resource requirements.
  • Cybercrime has stepped up again in 2024.

Solace Cyber was established precisely for this scenario. We have a well-defined process for handling cyber-attacks like LockBit, which involves a 6-step approach:

  1. Triage
  2. Analysis
  3. Contain and mitigate
  4. Remediate and Eradicate
  5. Recover
  6. Post-incident examination

It includes a thorough digital forensic analysis from step 2 where the output becomes a central component of business recovery. This is because understanding the attack is of critical importance:

  • Informing an initial infection date
  • The extent and spread of infection
  • Data exfiltration having an impact on regulatory positions
  • Ensuring that the attacker and any tooling or artefacts they leave behind are eradicated

It is critical that the analysis of digital evidence is carried out to an agreed plan. This will have been designed to provide the best and earliest chance of discovering a root cause, which is essential to inform remediation/eradication and recovery as well as supporting a legal take-down case if this is applicable. A legal take-down means we can assist in the legal enforcement that stops the criminals from publishing the data, thus undermining the ransom notice.

Solace’s Digital Forensic and Incident Response teams maintain consistent communication throughout. Dedicated Incident Managers and technical engineering leads provide updates during the Cyber Incident Response journey, utilising risk registers and working within change management processes, all from triage through to post-incident, delivering successful business recovery.

Key Take Aways

  • You will not be able to access your systems or data.
  • It is advised that you disconnect from the internet and shut your systems down to stop further infections including pc’s.
  • Your Office 365 system might also be compromised, enabling them to track and understand your responses. Avoid communicating with individuals through your primary email or team systems.
  • Threat actors will have infiltrated your system at least 2-4 weeks prior to you becoming aware. Your data will have already been exfiltrated. If your system is encrypted, this did not all happen last night.
  • Ransom costs can range from £0.5m - £3m.
  • Paying the ransom may contravene financial sanctions, which is a criminal offence and could lead to a custodial sentence or further financial penalty.
  • Data sold/published on the web puts your customers and staff at risk, implicating you in a Data Protection breach.
  • You will need to perform a data take down request from the initial location the data went too.
  • Do not overwrite the encrypted data. It is imperative to find out when the infection started and where the data was streamed to.
  • You must not rebuild from the latest back up as this will have been infected.
How do I maintain security in future to prevent a further ransomware attack?

Solace Cybers’ support continues beyond the recovery process. Once your business is back up and running, we work with you to transform your cyber security through a threat-informed approach utilising our 9-step approach Solace Global - Cyber 9 Step Process.

Frequently asked questions

Yes, LockBit is a type of Ransomware software that is currently threatening businesses in the UK, gathering money to fund terrorism around the world.

  • A link sent via email
  • Use of a web link
  • Purchased credentials
  • Not maintaining software updates

We recommend you adopt policies to:

  1. Educate your staff on the importance of cyber security and the risks of not complying
  2. Use strong passwords
  3. Multi factor authentication
  4. Remove old users
  5. Perform regular backups
  6. Deploy timely updates to software and systems

After recovering from LockBit, Solace Cyber recommends that you update your business continuity plan to account for lessons learnt during this attack & recovery.

Most ransomware breaches cost approx £500K with smaller email data breaches in the realm of £50K. There is a dichotomy of preserving the environment for forensics or recovering it quickly for less business interruption. The cost increases the longer it takes to identify the breach and resolve it.

A Cyber Security insurance claim is complex and includes reasonable expenses to investigate and remediate an incident along with cover for legal, business interruption, criminal liability, employment liability and ransom policies. The insurance industry is liable to deliver the business recovery BUT Cyber insurance is viewed as volatile within the industry and many insurance policies are not being validated correctly.

Navigating through this requires experience, which is where Solace Cyber can help.

Criminal organisations like Lockbit are paid by affiliates to launch cyber-attacks using their specific brand of malware that is known for its swift and efficient encryption capabilities. Even if the ransom is paid, the likelihood of having files decrypted and data restored is minimal, underscoring the necessity of employing a ransomware incident response team.

Check Links Monthly: The NCSC have documented the deliberations for paying ransomware: https://www.ncsc.gov.uk/ransomware/home

Important Reminder: It is a criminal offense to pay money to people who are subject to financial sanctions. The list of who is subject to financial sanctions is constantly changing.

The latest iteration can be found here: https://www.gov.uk/government/publications/financial-sanctions-consolidated-list-of-targets

Almost certainly, yes. It is possible that some of the data lost is classified as “Personal Data” to your customer. You have a legal obligation to protect that data but it may have been lost. You may also need to advise the Information Commissioner's Office https://ico.org.uk/. Check Links Monthly.

Your insurer/legal council will advise you on what to do and how to proceed with this. Solace has experience working with insurers and lawyers and can help in this relationship at this stressful time.

A ransomware attack poses the biggest threat to your business by:

  • Disabling your access to systems which may prevent you from operating machinery or from following steps through your business process.
  • Preventing you from accessing your data which may relate to suppliers and shipments, customers and their orders or steps in your business process.

If you have a business interruption, how do you know where you are in your supply chain for any one item and how do you carry on with your business? If it persists for a long time, how do you maintain your operation? And when your systems and data are restored, how do you backfill with any work you did and how do you operate going forward? Ransomware is second only to receivership for debilitating a business.

The NCSC is the UK National Cyber Security Centre https://www.ncsc.gov.uk/. They provide cyber security guidance and support, helping to make the UK the safest place to live and work online. They have defined a Cyber Incident Response procedure and they have approved and accredited suppliers to provide this service.

On 20 Feb 2024, the NCSC and the National Crime Agency announced that “law enforcement has taken control of technical infrastructure which underpins the LockBit operation, including its primary platform and leak site where data stolen from victims in ransomware attacks have previously been hosted.”

However these systems continually evolve and LockBit has since attempted to resurface and announced on 26th Feb 2024 that is was back online.

Action Fraud is the UK national fraud and cyber crime reporting centre https://www.actionfraud.police.uk/ and is where you should report fraud if you have been scammed, defrauded or experienced cybercrime in England, Wales and Northern Ireland.

Contact Us

Under Attack?

If your systems are showing signs of a LockBit attack, REMAIN CALM.

YOU MUST NOT TOUCH THEM, RESTORE OR OVERWRITE THE DATA (explanation above).

Contact Solace Cyber on 01202 308818 or complete our form for a call back from one of our experts.

We will act promptly to reduce your business downtime.

Request a callback

Solace Cyber, part of Solace Global, helps companies across the UK recover from ransomware attacks and data breaches.

Solace Cyber Limited is registered in England & Wales no. 14028838

Solace Cyber

Suite 6, Branksome Park House,
Branksome Business Park,
Bourne Valley Road,
Poole, BH12 1ED
United Kingdom

Telephone

Please note that calls may be recorded for security and training purposes.