FBI Tells LockBit 3.0 Victims it Holds 7,000 Valid Decryption Keys

Law enforcement agencies have successfully seized over 7,000 decryption keys from the notorious LockBit ransomware group, offering a lifeline to thousands of affected organizations worldwide.

This significant development was announced by FBI Cyber Division Assistant Director Bryan Vorndran during his keynote address at the 2024 Boston Conference on Cyber Security.

The discovery of the decryption keys is a result of an extensive operation named “Endgame,” which involved collaboration between FBI field offices in several cities and international partners from Denmark, France, Germany, and the Netherlands. This operation targeted four groups providing malware as a service, leading to the dismantling of key infrastructure and the arrest of multiple suspects globally.

LockBit, a prominent ransomware-as-a-service (RaaS) group, has been aa major threat since its emergence in late 2019. It operates by licensing its ransomware to affiliates, who carry out attacks on various sectors including healthcare, finance, and manufacturing. The affiliates encrypt victims' data and demand ransoms for its release, often employing double extortion tactics where they also threaten to leak stolen data.

The group, managed by the Russian coder Dmitry Khoroshev—known online by aliases such as “Putinkrab” and “Nerowolfe”—was notorious for its aggressive extortion methods. Khoroshev's network facilitated over 2,400 attacks globally, causing billions of dollars in damages.

The operation not only led to the seizure of decryption keys but also included the confiscation of 34 servers and the freezing of 200 cryptocurrency accounts linked to LockBit. The international collaboration, codenamed “Cronos,” saw the involvement of the National Crime Agency (NCA) in the UK, Europol, and police forces from ten countries, marking a significant blow to one of the most prolific ransomware groups.

The impact of LockBit's activities has been far-reaching. Among its high-profile victims were Boeing, Royal Mail, Continental Tires, and the Bank of America. The group's operations caused severe disruptions, especially in critical sectors like healthcare, where ransomware attacks compromised patient care and safety.

With the possession of over 7,000 decryption keys, law enforcement agencies are now able to assist victims in recovering their data without succumbing to ransom demands. The FBI is reaching out to known victims and encourages any organization affected by LockBit to visit the Internet Crime Complaint Center at ic3.gov for assistance.

Meanwhile, and considering that LockBit remains active despite the significant disruption, organizations are urged to adopt robust cybersecurity practices to mitigate the risk of ransomware attacks. Key recommendations include:

• Implementing multi-factor authentication (MFA) and strong password management.
• Maintaining regular, air-gapped, and encrypted backups.
• Ensuring effective logging and log management.
• Conducting thorough vulnerability and patch management.