Trend Micro details role in international law enforcement disruption of LockBit ransomware, including pre-release LockBit-NG-Dev
Trend Micro disclosed its part in a multinational law enforcement operation against the LockBit ransomware group, working with the FBI and the NCA. Per the vendor, undercover infiltration helped prevent the release of the group's next malware product, LockBit-NG-Dev, and Trend customers received protection before LockBit had finished testing it. The operation took over LockBit's leak site and disclosed information on group members and their previous activity. Trend says the operation also involved cryptocurrency seizure, arrests, indictments, sanctions and technical support for victims. LockBit accounted for roughly 25% of all ransomware leaks in 2023, according to Trend's leak-site tracking, and ransomware victims paid over $1 billion last year. This is a vendor press release, and the findings on the next LockBit version are to be published in a later blog post.
Technical Details
- The article names the in-development strain LockBit-NG-Dev but gives no technical analysis, IOCs or ATT&CK techniques.
- Trend's analysis of the next LockBit version is promised in a separate blog at research.trendmicro.com/lockbit-blog, to be issued with the NCA.
- The claim that Trend delivered protection to customers in advance is the vendor's own and is not independently verified in the article.
Remediation
The article gives no specific remediation steps. Trend Micro customers are said to have received protection against LockBit-NG-Dev automatically. Defenders should watch for the promised technical blog for detection content.
Linha do tempo
-
Trend Micro details role in international law enforcement disruption of LockBit ransomware, including pre-release LockBit-NG-Dev
ler a análise desta fonte ocultar
Trend Micro disclosed its part in a multinational law enforcement operation against the LockBit ransomware group, working with the FBI and the NCA. Per the vendor, undercover infiltration helped prevent the release of the group's next malware product, LockBit-NG-Dev, and Trend customers received protection before LockBit had finished testing it. The operation took over LockBit's leak site and disclosed information on group members and their previous activity. Trend says the operation also involved cryptocurrency seizure, arrests, indictments, sanctions and technical support for victims. LockBit accounted for roughly 25% of all ransomware leaks in 2023, according to Trend's leak-site tracking, and ransomware victims paid over $1 billion last year. This is a vendor press release, and the findings on the next LockBit version are to be published in a later blog post.
Technical Details
- The article names the in-development strain LockBit-NG-Dev but gives no technical analysis, IOCs or ATT&CK techniques.
- Trend's analysis of the next LockBit version is promised in a separate blog at research.trendmicro.com/lockbit-blog, to be issued with the NCA.
- The claim that Trend delivered protection to customers in advance is the vendor's own and is not independently verified in the article.
Remediation
The article gives no specific remediation steps. Trend Micro customers are said to have received protection against LockBit-NG-Dev automatically. Defenders should watch for the promised technical blog for detection content.