IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

LockBit hacking group to be 'more aggressive' after falling victim to large-scale DDoS attack

The ransomware group is currently embroiled in a battle after it leaked data belonging to cyber security company Entrust

The LockBit ransomware group has announced it will pursue more aggressive tactics and is actively recruiting new members after its sites were taken offline for days by distributed denial of service (DDoS) attack.

Announcing the new strategy in a Tweet, the group said targets will now be attacked using a triple extortion model, building on the double extortion method more widely adopted in recent years.

Triple extortion ransomware a relatively new technique that seeks to add the additional threat of a DDoS attack against the victim or their customers, in order to force them to pay. This builds on so-called double extortion ransomware, that sees hackers steal data as well as encrypting it on a victim's machine.

Triple extortion is relatively uncommon, but it was occasionally associated with attacks by the now-shuttered REvil group, which was known to deploy unusual tactics in its campaigns.

If adopted more broadly, it could present the next big development in the cyber security threat landscape facing businesses and other organisations.

In addition to triple extortion, LockBit also said it would begin including unique and randomised payment links in each ransom note, making it difficult for counter-measures like DDoS attacks to impact the threat actor’s payment site.

Why was LockBit targeted by a DDoS attack?

Soon after LockBit published the alleged leaked data on cyber security company Entrust on Friday 19 August, security researchers reported that the LockBit website was being targeted by what appeared to be a DDoS attack.

Security researcher Azim Shukuhi tweeted on Sunday that the attack was still active and the ransomware group was fending off 400 requests a second from more than 1,000 servers.

Shukuhi also said the AlphV/BlackCat ransomware group also sustained a similar attack at the same time, but its website was restored shortly afterwards. It's unknown at this time whether the attacks are linked.

Other than both attacks being believed to be based in, or supportive of, Russia, nothing significant links the LockBit and AlphV/BlackCat ransomware operations.

AlphV/BlackCat is believed to have recruited members from the Russia-linked REvil and DarkSide gangs, and LockBit has previously claimed it is based in the Netherlands, but researchers said that it does not target Russian entities.

Speaking to malware research group VX-Underground, a LockBit support agent accused Entrust of being behind the cyber attack against it.

LockBit supplied a screenshot showing the attack in action with requests appearing to have an aggressively worded note appended to the browser user agent field instructing LockBit to delete Entrust’s data.

If Entrust was behind the attack against LockBit, it would be an unprecedented incident involving a cyber security company conducting an offensive security operation against a ransomware organisation.

At the time of writing, LockBit’s leak site remains unreachable. Entrust has not confirmed if it is or isn’t behind the attack on LockBit.

Entrust announced a cyber attack on the company in late June 2022, but did not specify that it was ransomware in nature.

A LockBit support agent also shared screenshots allegedly showing the negotiations between the ransomware group and Entrust after the initial attack.

Related Resource

Escape the ransomware maze

Conventional endpoint protection tools just aren’t the best defence anymore

Whitepaper cover with overhead image of a man sat at a deska with a computer in the centre of a maze in the shadowsFree Download

According to data in the chat logs, the conversations shared with researcher Soufiane Tahiri date back to 29 June 2022 and the ransom was set at $8 million (£6.8 million) and later lowered to $6.8 million (£5.7 million).

Dominic Alvieri, another security researcher, obtained and tweeted a notice sent by Entrust to its customers, dated 6 July, informing them of the initial attack on June 18.

Alvieri said: “I believe the company wanted to keep it quiet during negotiations and quickly settle after notifying customers. When the cyber incident was exposed they just stopped negotiating”.

Who is behind the DDoS attacks?

It is unclear who is conducting the DDoS attack against LockBit, or the one against AlphV/BlackCat.

LockBit claims Entrust is behind the attack against it, however, it is unlikely that Entrust would ever admit to running offensive security operations, being a legitimate cyber security giant in its own right.

Despite being fairly common in cyber security, DDoS attacks are illegal to operate and it would be highly unlikely for a legitimate company to admit to carrying out its own.

Another theory is that it could be a rival ransomware gang trying to hit LockBit and make it appear as though it came from Entrust, however, this is would not make much economic sense.

Rates for DDoS-as-a-Service operations vary wildly, but according to Kaspersky’s data in 2017, the price for an attack like the one on LockBit - one that uses around 1,000 servers - would cost in the region of $7 (£6) per hour, or upwards of $400 (£340) a day.

Featured Resources

2022 State of the multi-cloud report

What are the biggest multi-cloud motivations for decision-makers, and what are the leading challenges

Free Download

The Total Economic Impact™ of IBM robotic process automation

Cost savings and business benefits enabled by robotic process automation

Free Download

Multi-cloud data integration for data leaders

A holistic data-fabric approach to multi-cloud integration

Free Download

MLOps and trustworthy AI for data leaders

A data fabric approach to MLOps and trustworthy AI

Free Download


Ransomware now strikes one in 40 organisations per week, Check Point finds

Ransomware now strikes one in 40 organisations per week, Check Point finds

27 Jul 2022
Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

Darktrace AI’s Antigena helps stop ransomware attack at Dordogne GHT

13 Apr 2022

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

15 Nov 2022
The top 12 password-cracking techniques used by hackers

The top 12 password-cracking techniques used by hackers

14 Nov 2022
Ex-Twitter tech lead says platform's infrastructure can sustain engineering layoffs

Ex-Twitter tech lead says platform's infrastructure can sustain engineering layoffs

23 Nov 2022