Police resurrect LockBit’s leak site to mock criminals and tease more info

Law enforcement agencies have updated the seized LockBit leak site again to troll the gang’s leaders and tease new information from the ongoing investigation into its operations.

Already in February, the LockBit cartel was humiliated when law enforcement agencies from the United Kingdom, the United States, and Europol officially announced the gang’s bust via its own online infrastructure.

"The months-long operation has resulted in the compromise of LockBit’s primary platform and other critical infrastructure that enabled their criminal enterprise. This includes the takedown of 34 servers in the Netherlands, Germany, Finland, France, Switzerland, Australia, the United States, and the United Kingdom," Europol said back then.

The leak site was taken down and replaced with a look-alike page boasting of the successful operation. Now, the same site has been resurrected by the police, and it is teasing a whole new set of information to come in the next few days.

According to the countdown active on the seized site, law enforcement that is currently controlling the website will reveal the identities of the LockBitSupps and other members of the gang on May 7th, 2024, at 14:00:00 UTC.

It also looks like law enforcement is promising an answer to the “$10M question – who is LockBitSupp.” LockBitSupp is the gang’s apparent leader, but so far, not much is known about the individual, except that they are based in Russia.

In February, investigators from the UK’s National Crime Agency said that the individual had engaged with law enforcement. Somewhat unusually, authorities hinted that LockBitSupp was driving a Mercedes and added they could probably not find spare parts for it.

Authorities are now also claiming that more light will soon be shed on some of LockBit’s affiliates because the investigators have allegedly learned “some facts and figures from the back-end” systems.

However, researchers at VX-underground have already poured some cold water on the law enforcement’s excited claims. They say they have spoken with LockBit’s members, and they claim that the authorities are lying.

“I don't understand why they're putting on this little show. They're clearly upset we continue to work,” a member of the gang allegedly said.

Indeed, despite February’s takedown, LockBit is still regularly posting victim details on several new dark leak sites. For instance, the gang claimed responsibility for the April 16th attack on the Hôpital de Cannes in southern France.

Earlier, Mickey Bresman, CEO of AD security and recovery platform Semperis, declared the latest developments in the LockBit saga worthy of its own Netflix series. Bresman called the public exchanges between law enforcement and LockBit “a mind game for credibility.”