Japanese police successful in decrypting data attacked by LockBit ransomware

Japan's National Police Agency has been successfully decrypting networks encrypted with the LockBit ransomware, the country’s press reported. At least three companies had data recovered without paying the attackers.

Japanese police have succeeded in decrypting corporate data locked by LockBit ransomware, a virus that encrypts data and demands a payment.

It seems the country’s law enforcement now has a new tool to fight cybercrime – thanks to the Cyber Police Department and the Cyber Special Investigation Team, newly established by the National Police Agency in April this year.

According to the Japanese media, teams at the Agency have so far recovered data of at least three companies targeted by LockBit ransomware. Ransomware encrypts files on the target's systems, rendering them inaccessible, and demands payment to restore access.

Malwarebytes, the anti-malware vendor, recently said LockBit was by far the most prolific ransomware gang in the world in 2022, conducting hundreds of confirmed attacks across the globe. But now Japan seems to have found a way to neutralize the threat.

"We were able to avoid losing data or needing to pay to get it back," a representative at auto parts maker Nittan, which suffered a LockBit attack in September, told the Nikkei daily.

Japan's police force has around 2,400 investigators and technical personnel focused on cybercrime. What’s also very important is that the police agency has shared its methods with investigative agencies in other countries.

It just so happens that the International Counter Ransomware Task Force will probably become operational next month.

The task force, which includes the US and its allies – Japan, too, will be led by Australia. It falls under the umbrella of the larger Counter Ransomware Initiative, a partnership that includes 36 countries and the European Union.

Allies will be anxious for the Japanese to share their expertise. A number of countries have tried to restore ransomware-hit systems, with limited success.

Already a few years ago, Europol and IT security companies began offering free recovery tools, and private companies have developed some of their own. However, these mostly work with older malware, and have not done much to curb the impact of newer versions.

Since coming onto the scene around 2020, LockBit has become one of the most prevalent ransomware families. Targets have ranged from big multinationals such as Continental to local governments.

Pundits think LockBit’s success stems from the group’s ability to combine a business-like approach with specialized technology. LockBit has also opted for a relatively under-the-radar approach, and experts say individual arrests are unlikely to shake the foundations of the cartel because it is well-staffed and decentralized.