The hackers got hacked! In an ironic twist, LockBit, the infamous ransomware-as-a-service gang, was breached. Watch the new episode of Cyberside Chats as @sherridavidoff and @MDurrin share the details and explain what it means for cyber defenders.

We explore what was leaked, why it matters, and how this incident compares to past takedowns like Conti. You'll also get the latest insights into the 2025 ransomware landscape, from victim stats to best practices for defending your organization.

Watch or listen now and get practical takeaways to strengthen your ransomware response playbook.

Watch: https://youtu.be/xr-8GhazgME
Listen: https://www.chatcyberside.com/e/lockbits-own-medicine-when-hackers-get-hacked/?token=914ee622fe9d4797c7a87bfedd0294f0

Latest issue of my curated #cybersecurity and #infosec list of resources for week #19/2025 is out!

It includes the following and much more:

The #Signal clone the Trump admin uses was hacked;

ICE's airline hacked;

The DragonForce #ransomware group claimed responsibility for recent cyberattacks on UK retailers;

NATO hosting the Locked Shields 2025 cyber defense exercise in Estonia;

The #LockBit ransomware gang was hacked!

Subscribe to the #infosecMASHUP newsletter to have it piping hot in your inbox every week-end

https://infosec-mashup.santolaria.net/p/infosec-mashup-19-2025

#LockBit ransomware gang has suffered a data breach after its dark web affiliate panels were defaced and replaced with a message linking to a MySQL database dump. #ransomwaregroup #dataleaking https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-hacked-victim-negotiations-exposed/

LockBit ransomware gang breached, secrets exposed - Oh dear, what a shame, never mind.

Read more in my article on the Tripwire State of Secu... https://www.tripwire.com/state-of-security/lockbit-ransomware-gang-breached-secrets-exposed #ransomware #databreach #guestblog #dataloss #lockbit

#LockBit #ransomware gang hacked, victim negotiations exposed

https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-hacked-victim-negotiations-exposed/

#LockBit's internal DB leak: they stored their passwords in plain text ! The encryption gods forgot to encrypt, and went with passwords like Lockbit123.

https://www.linkedin.com/posts/matthieu-garin-3336481_lockbit-ransomware-activity-7326276300694839296-zPJB?utm_source=share&utm_medium=member_ios&rcm=ACoAAA1EWg0Bu_zkYkbF2V7AK2EjSYvsnm4OSJU

The #LockBit #ransomware site was breached, database dump was leaked online
https://securityaffairs.com/177619/cyber-crime/the-lockbit-ransomware-site-was-breached-database-dump-was-leaked-online.html
#securityaffairs #hacking

Ransomware-Gruppe LockBit gehackt! Die Onion-Verhandlungsseite, über die Erpressungen und Opferkommunikation abgewickelt wurden, wurde gehackt. Die geleakten Daten könnten wichtige Hinweise geben; für Prävention und forensische Aufklärung.
#CyberSecurity #Ransomware #LockBit #Cybercrime #ITSecurity

seems #Lockbit got hacked

#ESETresearch discovered previously unknown links between the #RansomHub, #Medusa, #BianLian, and #Play ransomware gangs, and leveraged #EDRKillShifter to learn more about RansomHub’s affiliates. @SCrow357 https://www.welivesecurity.com/en/eset-research/shifting-sands-ransomhub-edrkillshifter/
RansomHub emerged in February 2024 and in just three months reached the top of the ransomware ladder, recruiting affiliates from disrupted #LockBit and #BlackCat. Since then, it dominated the ransomware world, showing similar growth as LockBit once did.
Previously linked to North Korea-aligned group #Andariel, Play strictly denies operating as #RaaS. We found its members utilized RansomHub’s EDR killer EDRKillShifter, multiple times during their intrusions, meaning some members likely became RansomHub affiliates.
BianLian focuses on extortion-only attacks and does not publicly recruit new affiliates. Its access to EDRKillShifter suggests a similar approach as Play – having trusted members, who are not limited to working only with them.
Medusa, same as RansomHub, is a typical RaaS gang, actively recruiting new affiliates. Since it is common knowledge that affiliates of such RaaS groups often work for multiple operators, this connection is to be expected.
Our blogpost also emphasizes the growing threat of EDR killers. We observed an increase in the number of such tools, while the set of abused drivers remains quite small. Gangs such as RansomHub and #Embargo offer their killers as part of the affiliate program.
IoCs available on our GitHub: https://github.com/eset/malware-ioc/tree/master/ransomhub

Neue Ransomware-Masche: Cybergangster geben sich als LockBit 4.0, Babuk oder Cl0p aus
#Cyberangriffe #Malware #affiliate #Cybercrime #Lockbit #RansomwareBetrug #ReExtortion https://sc.tarnkappe.info/d301d8

LockBit Developer Rostislav Panev Extradited from Israel to the US

https://hackread.com/lockbit-developer-rostislav-panev-extradited-israel-us/

Rostislav Panev, a 51-year-old Russian and Israeli national, has been extradited to the United States. He is suspected of being a developer for LockBit.

#LockBit #Russia #cybersecurity #ransomware

https://cnews.link/lockbit-ransomware-developer-extradited-to-the-us-1/

#LockBit ransomware developer Rostislav Panev appeared in a New Jersey court on Thursday after being extradited from Israel

https://therecord.media/lockbit-alleged-russian-developer-extradited-us-israel

#LockBit #ransomware developer Rostislav Panev was extradited from Israel to the U.S.
https://securityaffairs.com/175413/cyber-crime/lockbit-ransomware-developer-rostislav-panev-extradited-to-us.html
#securityaffairs #hacking

Alleged LockBit dev Rostislav Panev was extradited to the U.S. today.

https://www.justice.gov/usao-nj/pr/dual-russian-and-israeli-national-extradited-united-states-his-role-lockbit-ransomware

Ransomware Attacks Set Records in February: Cyble https://thecyberexpress.com/record-ransomware-attacks/ #TheCyberExpressNews #ransomwareattacks #AkiraRansomware #ContiRansomware #TheCyberExpress #RansomwareNews #cl0pransomware #PlayRansomware #FirewallDaily #Fogransomware #Ransomware #CyberNews #RansomHub #LockBit

Russian cybercrime group sent a message of congratulations to Kash Patel and an offer.

...the Lockbit administrator then offered an “archive of classified information for you personally, Mr. Kash Patel.” This, it was claimed, contained information that could “not only negatively affect the reputation of the FBI, but destroy it as a structure.”
#Lockbit #FBI https://www.forbes.com/sites/daveywinder/2025/02/26/this-data-could-destroy-the-fbi-russian-crime-gang-warns-kash-patel/

Trump administration retreats in fight against Russian cyber threats

The Trump administration has publicly and privately signaled that
it does not believe Russia represents a cyber threat against US national security or critical infrastructure,
marking a radical departure from longstanding intelligence assessments.

The shift in policy could make the US vulnerable to hacking attacks by Russia, experts warned,
and appeared to reflect the warming of relations between Donald Trump and Russia’s president, Vladimir Putin.
Two recent incidents indicate the US is no longer characterizing Russia as a cybersecurity threat.

#Liesyl #Franz, deputy assistant secretary for international cybersecurity at the state department,
said in a speech last week before a United Nations working group on cybersecurity that
the US was concerned by threats perpetrated by some states but only named China and Iran,
with no mention of Russia in her remarks.

Franz also did not mention the Russia-based #LockBit #ransomware group,
which the US has previously said is the most prolific ransomware group in the world and has been called out in UN forums in the past.

The treasury last year said LockBit operates on a ransomeware-as-service model, in which the group licenses its ransomware software to criminals in exchange for a portion of the paid ransoms.

In contrast to Franz’s statement, representatives for US allies in the European Union and the UK focused their remarks on the threat posed by Moscow,
with the UK pointing out that Russia was using offensive and malicious cyber-attacks against Ukraine alongside its illegal invasion.

“It’s incomprehensible to give a speech about threats in cyberspace and not mention Russia and it’s delusional to think this will turn Russia and the FSB [the Russian security agency] into our friends,”
said James Lewis, a veteran cyber expert formerly of the Center for Strategic and International Studies think tank in Washington.

“They hate the US and are still mad about losing the cold war. Pretending otherwise won’t change this.”
The US policy change has also been established behind closed doors.

https://www.theguardian.com/us-news/2025/feb/28/trump-russia-hacking-cyber-security?CMP=Share_iOSApp_Other

LockBit's alleged leader claims to have stolen FBI-damaging data in a birthday message to Trump's FBI pick, Kash Patel.

#LockBit #cybersecurity #FBI #Trump #ransomware #cybercrime

https://cnews.link/lockbit-ransomware-gang-claims-fbi-kash-patel-birthday-2/