FBI recovers over 7,000 LockBit decryption keys

The FBI has recovered over 7,000 decryption keys used by LockBit to encrypt private and confidential data. The intelligence service encourages victims to reach out to the Internet Crime Complaint Center (IC3) so that they can retrieve their data for free.

According to the Cybersecurity and Infrastructure Security Agency (CISA), LockBit is one of the most active ransomware groups in the world. The hacker’s collective is said to be responsible for over 2,400 cyber attacks since 2019, causing billions of dollars in damages. Royal Mail, Boeing, Subway and Dutch soccer organization KNVB are some of the more prominent victims of LockBit.

LockBit operates through a criminal business model known as Ransomware-as-a-Service (RaaS). That means they don’t carry out cyber attacks themselves, but leave it up to lesser-skilled cybercriminals. In return, the developers of the malware receive a 15 to 20 percent cut of all illicit revenues.

“LockBit affiliates steal your data, lock it down, and demand a payment to return your access to it. Then, if you pay the ransom, they return your access to your data. But they also keep a copy, and sometimes they demand a second payment to stop them from releasing your personal or proprietary information online,” FBI Cyber Division Assistant Director Bryan Vorndran said during a conference on cybersecurity.

FBI is handing out decryption keys

In February of this year, the FBI and a coalition of international law enforcement agencies took down the digital infrastructure of LockBit. Thanks to ‘Operation Cronos’ 34 servers were taken offline. It also resulted in two arrests and the closing of 14,000 fraudulent accounts and 200 cryptocurrency accounts.

LockBit uses ransomware to encrypt private and confidential information stored on their victims’ computers or servers. Normally victims have to pay an extortion fee to get a hold on one of those keys and decipher the encryption. But not today.

The FBI has unlocked over 7,000 decryption keys. Vorndran urges victims to contact the Internet Crime Complaint Center (IC3) so they can help to reclaim their data for free.

The investigation into LockBit is still ongoing. The FBI is looking for Dimitri Khoroshev, a Russian coder believed to be the founder of LockBit. He has been banned from traveling and his assets have been frozen. US authorities are offering a 10 million dollar reward for anyone who can provide information that will lead to Khoroshev’s arrest or conviction