After LockBit takedown, police try to sow doubt in cybercrime community | CyberScoop<\/title> <meta name=\"description\" content=\"After taking down the world's most prolific ransomware group, a police messaging campaign is trying to undermine its leaders.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/lockbit-takedown-messaging-campaign\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"After LockBit takedown, police try to sow doubt in cybercrime community\"> <meta property=\"og:description\" content=\"After taking down the world's most prolific ransomware group, a police messaging campaign is trying to undermine its leaders.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/lockbit-takedown-messaging-campaign\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2024-02-23T22:31:23+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/02\/after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community-1.png\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1227\"> <meta property=\"og:image:type\" content=\"image\/png\"> <meta name=\"author\" content=\"AJ Vicens\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@AJVicens\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1706643139g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/_static\/??\/wp-content\/mu-plugins\/search\/elasticpress-next\/dist\/css\/related-posts-block-styles.min.css,\/wp-content\/plugins\/embedpress\/Gutenberg\/dist\/blocks.style.build.css?m=1708535870\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/_static\/??\/wp-content\/plugins\/embedpress\/assets\/css\/embedpress.css,\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1708725624\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=17ca7a1ec36db7d13744\" media=\"all\">\n<link rel=\"stylesheet\" id=\"all-css-10\" href=\"https:\/\/cyberscoop.com\/_static\/??\/wp-includes\/css\/dashicons.min.css,\/wp-content\/plugins\/embedpress\/assets\/css\/plyr.css?m=1707697092\" type=\"text\/css\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/79410\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.4.3\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=79410\">\n<link rel=\"alternate\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Flockbit-takedown-messaging-campaign%2F\">\n<link rel=\"alternate\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Flockbit-takedown-messaging-campaign%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-79410 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/lockbit-takedown-messaging-campaign\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.38679245283\">\n<div class=\"single-article__header-content\" readability=\"31.297071129707\">\n<ul class=\"single-article__eyebrow\">\n<li class=\"single-article__category\"> <a class=\"single-article__category-link\" href=\"https:\/\/cyberscoop.com\/news\/threats\/cybercrime\/\"> <span>Cybercrime<\/span> <\/a> <\/li>\n<\/ul>\n<p> After taking down the world’s most prolific ransomware group, a police messaging campaign is trying to undermine its leaders. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"409\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/02\/after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community.png?resize=640%2C409&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/02\/after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community-1.png 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/02\/after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community-1.png?resize=300,192 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/02\/after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community-1.png?resize=768,491 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/02\/after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community-1.png?resize=1024,654 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/02\/after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community-1.png?resize=1536,982 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/02\/after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community-1.png?resize=600,383 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/02\/after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community-1.png?resize=263,168 263w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/02\/after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community-1.png?resize=527,337 527w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/02\/after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community-1.png?resize=1056,675 1056w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2024\/02\/after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community-1.png?resize=1319,843 1319w\" sizes=\"(max-width: 1056px) 100vw, 1056px\"><figcaption> Image posted to the seized LockBit website Friday, Feb. 23, 2024 (CyberScoop). <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"58.569271928148\"><body readability=\"118.76286173633\"><\/p>\n<p>After seizing the digital infrastructure of the ransomware group LockBit earlier this week, the law enforcement agencies behind that operation have carried out an unusual messaging campaign designed to create questions in the minds of criminal hackers about the presence of infiltrators in their midst. <\/p>\n<p>On Monday, security researchers focused on cybercrime noticed that the Federal Bureau of Investigation together with the U.K.\u2019s National Crime Agency and a host of other law enforcement agencies had <a href=\"http:\/\/cyberscoop.com\/fbi-operation-seizes-infrastructure-of-lockbit-ransomware-group\/\">apparently seized<\/a> the main website used by LockBit, the world\u2019s most prolific ransomware operator, to shame its victims into paying exorbitant extortion demands.<\/p>\n<p>As part of the operation, police replaced the clickable links that previously linked to LockBit victims\u2019 data with their own links, including one to a press release and others announcing sanctions, arrests, indictments and decryption information.<\/p>\n<p>Tantalizingly, the site included a link promising that information would be released Friday about the head of LockBit, a persona known online as \u201cLockBitSupp.\u201d Friday\u2019s reveal did not expose his identity, but police say they know who he is, where he lives and how much he\u2019s worth. As if to twist the knife, police said that LockBitSupp \u201chas engaged with Law Enforcement\u201d \u2014 without specifying what they meant.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The National Crime Agency declined to answer questions about Friday\u2019s post related to LockBitSupp\u2019s identity. <\/p>\n<p>Experts and longtime observers of LockBit say the message \u2014 as well as the overall strategy of taking complete control of LockBit infrastructure and exposing its affiliates \u2014 aims to both undermine trust in LockBit among the cybercrime ecosystem and potentially provoke a response from the leader himself.<\/p>\n<p>\u201cThis is a psychological operation, and I have been begging anyone who will listen to me to implement doing these [types] of mitigation strategies,\u201d said Jon DiMaggio, chief security strategist for Analyst1. Doing so, DiMaggio argued, can seed \u201cdoubt in the minds of other cyber criminals who will be less likely to trust LockBit and work for him.\u201d <\/p>\n<p>DiMaggio and his colleagues have reported extensively <a href=\"https:\/\/analyst1.com\/ransomware-diaries-volume-3-lockbits-secrets\/\">on LockBit activities<\/a> and carried out interviews with LockBitSupp that reveal a confident character who cares about his reputation and how he is perceived. That confidence seems to fuel a belief that he can operate in perfect anonymity: In January, he <a href=\"https:\/\/flare.io\/learn\/resources\/dark-web-drama-lockbit-and-the-an-security-breach-saga\/\">offered a $10 million reward<\/a> to anyone who could reveal his identity.<\/p>\n<p>DiMaggio said the law enforcement\u2019s messaging campaign seems \u201cdesigned for him.\u201d <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Kurtis Minder, the co-founder and CEO of GroupSense and a longtime ransomware negotiator, told CyberScoop that his dealings with LockBit representatives over the years suggest that LockBitSupp is \u201cvolatile,\u201d and that the messaging campaign may be an intentional provocation \u201cto get him to say something stupid\u201d that might be used against him. <\/p>\n<p>By insinuating that LockBitSupp is working with law enforcement in some undefined capacity, the messaging campaign also seeks to create suspicion between LockBit and the affiliates that pay handsomely to use its services. <\/p>\n<p>\u201cLaw enforcement is sowing the seeds of distrust,\u201d Alexander Leslie, an intelligence analyst with Recorded Future, <a href=\"https:\/\/x.com\/aejleslie\/status\/1761125770431234432?s=20\">said Friday in a post on X<\/a>. \u201cAs if the actions of the last week weren\u2019t enough\u2026 now affiliates have to be concerned that LockBitSupp is not only a liar, but a snitch.\u201d<\/p>\n<p>Allan Liska, a threat intelligence analyst at Recorded Future\u2019s Insikt Group, told CyberScoop in an email Friday that the police message about communicating with law enforcement could be interpreted in two ways.<\/p>\n<p>First, it could imply that LockBitSupp is an informant for law enforcement, an accusation Liska said has been made by other ransomware gangs, including the group known as ALPHV, who have a clear motive in trying to denigrate a rival. Or, Liska said, \u201claw enforcement may have infiltrated LockBitSupp\u2019s inner circle and LockBitSupp may have been unwittingly sharing sensitive information with law enforcement.\u201d<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Either scenario would devastate trust in LockBitSupp as he tries to reconstitute his operation, Liska noted. <\/p>\n<p>In combating online crime, law enforcement agencies are also realizing that they need to win a PR battle against groups that historically have operated with impunity and mocked their opponents online. <\/p>\n<p>By seizing their website and using it to promote material that is harmful to LockBit\u2019s criminal enterprise, law enforcement is \u201cturning their tools against them,\u201d Adam Hickey, the former deputy assistant attorney general with the Department of Justice\u2019s National Security Division, told CyberScoop. <\/p>\n<p>\u201cLaw enforcement recognizes that if they are to be seen as effective, their disruption needs to sell, it needs to land as impactful,\u201d Hickey said. \u201cI think that splash page is just an attempt to make this more marketable.\u201d<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\" readability=\"1.060546875\">\n<div class=\"author-card\" readability=\"8\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/02\/after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community.jpg?w=640&ssl=1\" alt=\"AJ Vicens\"> <\/figure>\n<\/p><\/div>\n<p><h4 class=\"author-card__name\">Written by AJ Vicens<\/h4>\n<p> AJ covers nation-state threats and cybercrime. He was previously a reporter at Mother Jones. Get in touch via Signal\/WhatsApp: (810-206-9411). <\/p>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Geopolitics<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/lockbit-takedown-messaging-campaign\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>After LockBit takedown, police try to sow doubt in cybercrime<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[282,669,462,1569,46],"tags":[286,671,463,1570,54],"class_list":["post-2587","post","type-post","status-publish","format-standard","hentry","category-cybercrime","category-federal-bureau-of-investigation-fbi","category-lockbit","category-national-crime-agency","category-ransomware","tag-cybercrime","tag-federal-bureau-of-investigation-fbi","tag-lockbit","tag-national-crime-agency","tag-ransomware"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybercrime\/\" rel=\"category tag\">cybercrime<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/federal-bureau-of-investigation-fbi\/\" rel=\"category tag\">Federal Bureau of Investigation (FBI)<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/lockbit\/\" rel=\"category tag\">LockBit<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/national-crime-agency\/\" rel=\"category tag\">National Crime Agency<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ransomware\/\" rel=\"category tag\">ransomware<\/a>","tag_info":"ransomware","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/2587","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=2587"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/2587\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=2587"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=2587"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=2587"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":2587,"date":"2024-02-23T22:31:23","date_gmt":"2024-02-23T22:31:23","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=79410"},"modified":"2024-02-23T22:31:23","modified_gmt":"2024-02-23T22:31:23","slug":"after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/02\/23\/after-lockbit-takedown-police-try-to-sow-doubt-in-cybercrime-community\/","title":{"rendered":"After LockBit takedown, police try to sow doubt in cybercrime community"},"content":{"rendered":"