LockBit targets small Canadian town with extortion

The notorious ransomware gang locked the internal servers and encrypted the data of St. Marys, a town in southwestern Ontario.

The latest LockBit ransomware attack shows that no one is safe from global cybercrime gangs. The group listed a small town of St Marys on its dark web victim site.

According to the statement from the town’s officials, the incident happened on 20 July. Threat actors breached St Mary’s internal server and encrypted data stored there.

“We have a skilled and knowledgeable team of Town staff, cyber security experts and legal counsel working around the clock to resolve any issues related to this incident,” the town’s Mayor Al Strathdee said.

Critical municipal services such as fire, police, transit, and water/wastewater systems were unaffected by the incident and are operating as usual.

At the time of publishing, the visitors of St Mary’s website are greeted with a message saying the town is investigating a cyber security incident that locked an internal server and encrypted the data.

The LockBit cartel gave the town a deadline to pay the ransom or have their data published online.

Leading the race

LockBit ransomware leads the digital extortion underworld. The latest ransomware report by threat intelligence firm Digital Shadows shows that in the second quarter of 2022, LockBit was the most active group by an overwhelming margin.

LockBit and its affiliates accounted for a third of all cyberattacks attacks involving organizations being posted to ransomware data-leak sites. Researchers attributed 231 victims to LockBit while the second-place holder, problem-ridden Conti, had 70.

While LockBit is far from the only successful ransomware group, it has outlasted many competitors. Prominent groups like REvil, Darkside, and Cl0p came and went, either regrouping or disbanding.

More recently, the Conti ransomware gang seems to have closed up shop once at the top of the ransomware game. Meanwhile, LockBit has been in the game since 2019, a lifetime in the ransomware business, releasing the second and, recently, the third generation of malware.

The number of ransomware attacks grew last quarter compared to the beginning of the year. Digital Shadows counted 705 victims, 21% more than over previous months. Righi thinks that we’ll only see more attacks as the year progresses.