LockBit operators announced another major breach against Secure Energy, a US-based player in the field of electricity, natural gas, and solar power. There are no details available regarding the breach, aside from the short summary posted by the hackers.
The victim didn’t release any public statement regarding the attack, but this was to be expected. Most ransomware victims prefer to ignore the event and not give the hackers the advertisement they want. Some do prefer to negotiate and even pay the ransom, though.
That’s especially the case with companies that lose valuable confidential data during the attack. They prefer to pay the ransom to make sure the data doesn’t leak publicly, despite the records showing that this rarely works.
While some ransomware actors will keep their word and delete the data, most won’t. And the victim can’t verify the hackers’ claims; they can only hope for honesty.
In reality, most ransomware gangs prefer to keep the data for themselves for later use. Or sell or share it with other ransomware actors or cybercriminal entities for profit. This is the main reason why cybersecurity experts advise against paying the ransom.
Or even negotiating with the hackers. Studies show that the simple fact of communicating with them, even if no consensus is reached, marks the target as vulnerable. The hackers will automatically place the victim on their blacklist.
This means that the victim is highly likely to be attacked again in the future. Both by the same gang and by others, because the word spreads fast on the Dark Web.
LockBit is currently the largest and most active ransomware gang in the world. It’s also the most advanced, using modern tools, an ever-upgrading code, and evolving tactics. Operation Cronos, despite failing on the large scale, leaked some interesting info in this sense.
According to the FBI, LockBit 4.0 was in the works at that time. Not only that, but the new version appeared to be in advanced stages of development. The operation also revealed numerous active victims that the feds helped overcoming the decryption.
Then there’s the fact that LockBit operators managed to survive the Cronos operation and recompose themselves. They were only taken offline for several days before bouncing back in full force and attacking none other than the FBI itself.
Since then, LockBit has returned to its standard MO, attacking multiple targets per day completely unhinged. It’s unclear how the FBI will respond to this, but as history shows, a response is just a matter of time.
We believe security online security matters and its our mission to make it a safer place.