LockBit 3.0 gang demands $3 million ransom after stealing 600GB of data

According to reports, Fullerton India, an Indian credit company, suffered a cyberattack by the LockBit 3.0 ransomware gang in April. Over 600GB of critical data was stolen, affecting some of the company's business operations. The company subsequently issued a statement stating that it was gradually restoring services for customers and had collaborated with top global security experts, resulting in a significant improvement in the network security environment. As a "precautionary measure," they had to operate offline temporarily.

The LockBit 3.0 ransomware gang demanded a US$3 million ransom from the company, threatening to publish all stolen data otherwise. The hackers also allowed the company to pay US$1,000 per day to extend the payment deadline.

▍Massive Leak of Customer Data

Although the company claimed that the attack had been resolved, on 8 May, the LockBit 3.0 group leaked 600GB of private data stolen from Fullerton India on the dark web, including account statuses, loan agreements, banking agreements, financial documents, international transfers, and personal information.

Screenshot of compromised customer data

Screenshot of mortgage application

▍The Victim List Continues to Grow

Investigation results show that this company is not the only recent victim of LockBit 3.0 attacks. A chemical enterprise in Japan had 1TB of data stolen, while another Swedish brewery lost 136GB of data.

▍The '007' Organisation - Harder Working Than '996'

As the most active hacking group at present, LockBit 3.0 is still undergoing frantic recruitment expansion. The figure below shows that the gang is recruiting testers. In addition to regular requirements such as relevant experience in OS administrative operations, bug tracking systems, and various software versions, the group also requires its new recruits to have no private life, work 24/7, be able to keep secrets, and be insatiable.

Recruitment notice posted by LockBit 3.0 gang

▍How LockBit 3.0 Ransomware Attacks

LockBit 3.0 (also known as LockBit Black) typically attacks via emails, malware downloads, Remote Desktop Protocol (RDP) attacks, and other methods. Attackers usually employ social engineering tactics to deceive victims into clicking malicious links or downloading malicious attachments, thereby infecting the victim's computer with ransomware.

Once infected, LockBit 3.0 scans files on the computer and encrypts the victim's files using advanced encryption algorithms. Once encryption is complete, the ransomware generates a ransom note on the victim's computer, demanding a ransom payment in exchange for the decryption key. The ransom note usually includes instructions on how to pay, the payment method, and the ransom amount.

LockBit 3.0 also features self-protection capabilities to detect and evade detection by security software. It can detect and bypass security software's behavior monitoring, file scanning, and process monitoring features, enabling it to successfully attack the victim's computer.

In summary, LockBit 3.0 is a highly dangerous ransomware that can cause severe damage to victims' computers and data. To avoid being attacked by LockBit 3.0, users should enhance their security awareness, back up data regularly, install security software, update systems and software, and employ encryption techniques, among other measures.

The Security Validation Platform of Saixun has incorporated this ransomware gang's attack techniques into its simulated attack library. Searching for "LOCKBIT.BLACK" within the platform provides access to relevant attack simulation experiments, helping to verify whether your security defense system can effectively counter this attack method.

Build Long-term Security through Continuous Validation

Long press the image to scan the code and add 【Official Customer Service】