LockBit has been dismantled, but we shouldn’t get too excited, it could quickly reappear, cyber experts predict

Cyber ​​experts estimate that the dismantling of LockBit by the authorities will not lead to his death however. The chances of him coming back to the forefront are more than great.

One of the most famous hacker groups, LockBit, was dismantled this week by authorities who do not hesitate to use their own tools to promote their operations. But ” laughs best who laughs last “, some hackers may be saying to themselves today. For some cybersecurity experts, we should already expect to see LockBit reappear, in one form or another.

Calm in ransomware attacks will eventually give way to LockBit successors

Active since September 2019, the group specializing in LockBit ransomware has become a reference in the cybercriminal world, in that it is the one to have caused the most publicly extorted victims. In 2023 alone, he snared 396 organizations in the United States, 65 in the United Kingdom and 51 in France, the third country where he was most prolific.

This dismantling, which ranges from the arrest of Lockbit employees to the takeover of the website by the authorities, will have consequences for certain cybercriminals, who may not want to try the adventure again. But while a reduction in the number of ransomware attacks is to be expected, it will only be temporary.

For Alexander Zabrovsky, analyst at Kaspersky, “ we should not overlook the possibility that another group will seize this opportunity to fill the void left by LockBit, learning from its mistakes and being all the more vigilant in implementing its operations “. The search for profit remains the primary motivation for hackers, and there is no doubt that Lockbit will reappear. But when, how and in what form?

Highly organized groups that are dismantled usually end up reappearing

Same story with Check Point, whose experts point out that “ most of the time this type of group does not disappear “. The company’s cyber researchers believe that we can and should expect ” to a rebranding, a potential name change in the coming weeks, or months “. So we might as well say it again: LockBit is probably not definitively dead.

On the other hand, the halt brought by the American, British and even French authorities is more than significant. It also follows Russia’s banning of LockBit last month from the country’s two main hacking forums. The group, or what remains of it, and its successors, will have to work hard to remobilize. This is a direct result of the very professional operation of LockBit history.

The collective operated thanks to a partnership program, with 194 affiliate accounts. “ To become a member of the program, applicants had to pass an interview and post a deposit of one bitcoin, a measure intended to protect ransomware perpetrators from law enforcement and cybersecurity experts “, explains Kaspersky. LockBit provided “ ransomware and infrastructure to other cybercriminals, affiliates, who then carried out the attacks », adds Check Point. It will probably take time for the group to rise from the ashes. But he will come back, it’s inevitable.