LockBit is gaining strong momentum! 2.0 dominates the market, while 3.0 launches a bug bounty program

LockBit ransomware affiliates are infecting victims' devices with malware by disguising it as a copyright claim.

Recipients of these emails receive warnings about copyright infringement, alleging that they have used media files without the creator's permission. These emails demand that the recipients remove the infringing content from their websites, or they will face legal action.

Analysts at AhnLab in South Korea discovered that these emails instruct recipients to download and open an attachment to view the infringing content.

Phishing Emails Used in the Attack Campaign Targeting South Korea

The attachment is a password-protected ZIP archive containing a compressed file, which in turn holds an executable file disguised as a PDF document but is actually an NSIS installer. This compression and password protection are used to evade detection by email security tools.

If the victim opens the supposed "PDF" to see which images were used illegally, the malware will load and encrypt the device with LockBit 2.0 ransomware.

▌Copyright Claims and Malware

While the use of copyright infringement claims is intriguing, it is neither new nor exclusive to LockBit affiliates, as many malware distribution campaigns use the same bait.

BleepingComputer recently received a flurry of such emails, and further analysis revealed that these emails are distributing the BazarLoader or Bumblebee malware loaders.

Pushing malware using copyright infringement phishing email baits

Bumblebee is used to deliver second-stage payloads, including ransomware, so opening one of these files on your computer could lead to a rapid and catastrophic attack.

If a copyright claim is not straightforward but instead requires you to open an attachment to view details of the violation, it is highly likely not genuine.

▌LockBit 2.0 Dominates the Top

According to the May threat report released by NCC Group, a total of 236 ransomware attacks were reported that month, with LockBit 2.0 accounting for 40%.

Victims listed per ransomware operation in May 2022

The notorious ransomware operation recorded a whopping 95 victims in May alone, compared to a total of 65 victims for Conti, BlackBasta, Hive, and BlackCat combined.

This continues a trend observed by Intel471, which placed LockBit 2.0 at the top of the most prolific ransomware in Q4 2021 and further solidifies the group's position as one of the most widespread threats.

▌LockBit 3.0 Released

After two months of beta testing, LockBit has released an improved Ransomware-as-a-Service (RaaS) called LockBit 3.0, and the new version has already been used in attacks.

While it is not yet clear what technical changes were made to the encryptor, the ransom note is no longer named "Restore-My-Files.txt" but is instead changed to the naming format [id].README.txt, as shown below.

LockBit 3.0 ransom note

▌LockBit 3.0 Bug Bounty Program

With the release of LockBit 3.0, the operation introduced the first bug bounty program offered by a ransomware gang, asking security researchers to submit vulnerability reports in exchange for rewards.

"We invite all security researchers, ethical and unethical hackers on the planet to participate in our bug bounty program. Compensation amounts range from $1,000 to $1,000,000," reads the LockBit 3.0 bug bounty page.

LockBit 3.0 Bug Bounty Program

Furthermore, LockBit offers bounties not only for vulnerability rewards, but also for "brilliant ideas" to improve the ransomware and for doxxing the affiliate program manager. They offered a $1 million reward on the XSS hacking forum in April for identifying the affiliate manager known as LockBitSupp.

LockBitSupp offers a $1 million bounty to anyone who identifies them

▌Upcoming ZCash Payment Method

When opening the Tor site for LockBit 3.0 negotiation and data leak sites, visitors are greeted with an animated logo surrounded by various cryptocurrency icons.

The cryptocurrency icons displayed in this animation are Monero and Bitcoin, and also include the privacy coin called Zcash.

New cryptocurrency animation on the LockBit 3.0 website

Cryptocurrency tracking firms and law enforcement seizures have repeatedly demonstrated that Bitcoin is traceable, and while Monero is a privacy coin, the vast majority of US cryptocurrency exchanges do not sell it.

Zcash is also a privacy coin and is harder to track. It is currently sold on Coinbase, the most popular cryptocurrency exchange in the US, making it easier for victims to purchase to pay ransoms.

However, if the ransomware switches to accepting payments in this token, it may face government pressure to be delisted from US exchanges.

▌LockBit Selling Victims' Stolen Data?

LeMagIT's Valery Marchive discovered that LockBit 3.0 is utilizing a new extortion model that allows attackers to buy data stolen during an attack.

One of the JavaScript files used by the new LockBit 3.0 data leak site displays a new HTML modal dialog that allows people to purchase data leaked on the site.

As shown in the image below, it will offer the ability to buy data and download it via Torrent or directly on the website. Available options can be determined based on the size of the stolen data, with Torrent used for large data dumps and direct downloads for smaller amounts of data.

JavaScript source code showing the new data extortion method

As the LockBit 3.0 data leak site currently does not contain any victims, it is not yet clear how this new extortion tactic will work, or even if it has been enabled.

LockBit is one of the most active ransomware operators, and its public-facing operators actively engage with other attackers and the cybersecurity community. Due to its constant adoption of new tactics, techniques, and payment methods, security and network professionals must keep abreast of the latest developments.

SecZone Safety Lab collects the latest threat intelligence in the internet for customers 24/7, and rapidly simulates intrusions on a large scale before ransomware is deployed. Under the premise of ensuring safety, we can simulate both the transmission of ransomware and the execution of ransomware, helping you verify whether your defense system can produce the correct response to these attack methods.

| Reference sources: https://www.bleepingcomputer.com/news/security/fake-copyright-infringement-emails-install-lockbit-ransomware/ https://www.bleepingcomputer.com/news/security/lockbit-30-introduces-the-first-ransomware-bug-bounty-program/