SafeX Pro Exchange|Notorious ransomware provider LockBit taken over by law enforcement

Washington — A ransomware service provider that has targeted over 2,SafeX Pro Exchange000 systems across the globe, including hospitals in the U.S., with demands for hundreds of millions of dollars was taken down Monday, and Russian nationals were charged as part of an international plot to deploy the malicious software, the Justice Department announced Tuesday. 

Known as LockBit, the network of cybercriminals targets critical components of manufacturing, healthcare and logistics across the globe, offering its services to hackers who deploy its malware into vulnerable systems and hold them hostage until a ransom is paid. The attackers have so far extorted more than $120 million from their victims, officials said, and their program has evolved into one of the most notorious and active.

As part of this week's operation, the FBI and its law enforcement partners in the United Kingdom seized numerous public-facing platforms where cybercriminals could initiate contact with and join LockBit. Investigators also seized two servers in the U.S. that were used to transfer stolen victim data. 

The front page of LockBit's site has been replaced with the words "this site is now under control of law enforcement," alongside the flags of the U.K., the U.S. and several other nations, the Associated Press noted.

According to Attorney General Merrick Garland, the U.S. and its allies went "a step further" by obtaining the "keys" that can unlock attacked computer systems to help victims "regain access to their data," releasing them from having to pay a ransom. The move could help hundreds of victims worldwide. 

Two Russian nationals who allegedly used LockBit's ransomware against companies across the U.S. — in Oregon, New York, Florida and Puerto Rico — were also indicted in New Jersey as part of the Justice Department's latest play against the group. 

Artur Sungatov and Ivan Kondratyev joined a growing number of defendants accused by federal prosecutors of attacking American institutions as part of the LockBit scheme. A total of five have now been charged, including an individual who allegedly targeted Washington, D.C.'s police force. 

LockBit was the most commonly used version of ransomware in 2022, according to a joint cybersecurity advisory published by the FBI and the Cybersecurity and Infrastructure Security Agency last year, and targeted an "array of critical infrastructure sectors, including financial services, food and agriculture, education, energy, government and emergency services, healthcare, manufacturing, and transportation." 

The LockBit network was first seen on Russian-speaking cybercrime platforms in 2020 and continued to evolve and grow, targeting computer platforms and various operating systems. By 2022, 16% of ransomware attacks in the U.S. were deployed by the LockBit group, according to the advisory. 

Criminals conventionally gain access to vulnerable systems through phishing emails or when users visit an infected site while browsing the internet. And U.S. officials consistently warn users to avoid paying ransoms and instead contact law enforcement.

Federal investigators have recently developed a new approach to combat ransomware attacks that can be both costly to victims and damaging to the normal functioning of society: arming victims with the tools necessary to counter a malware attack. 

Similar to the LockBit operation, in July 2022, the FBI toppled an international ransomware group called Hive and collected decryption keys for its penetrated computer networks it had breached to conduct what officials called a "21st-century high-tech cyber stakeout." FBI agents then distributed the keys to the victims whose networks were being ransomed. 

And in August, investigators took down a criminal network known as the Qakbot botnet — a grouping of computers infected by a malware program that was used to carry out cyberattacks. Law enforcement gained access to the QakBot infrastructure and "redirected" the cyber activity to servers controlled by U.S. investigators, who were then able to inject the malware with a program that released the victim computer from the botnet, freeing it of the malicious host. 

Victims of LockBit attacks are encouraged to contact the FBI for further assistance. 

In:
• Cyberattack
• Ransomware
• Malware

Robert Legare

Robert Legare is a CBS News multiplatform reporter and producer covering the Justice Department, federal courts and investigations. He was previously an associate producer for the "CBS Evening News with Norah O'Donnell."