Lockbit cybercrime gang says it is back online

The group, notorious on the internet's criminal underground for using malicious software called ransomware to digitally extort its victims, was the target of an unprecedented international law enforcement operation last week in which its members were arrested and indicted.

Lockbit's own website was used by police to taunt its ringleaders, and last Friday police said its leader "LockbitSupp" was co-operating with law enforcement, without elaborating.

In a lengthy, rambling statement dated on Saturday, the group said law enforcement had hacked Lockbit's darkweb site - where the gang leaks data stolen from its victims - using a vulnerability in the PHP programming language, which is widely used to build websites and online applications.

"All other servers with backup blogs that did not have PHP installed are unaffected and will continue to give out data stolen from the attacked companies," said the statement, which was posted in English and Russian on a new version of Lockbit's darkweb site.

A representative for the United Kingdom's National Crime Agency, which led the international effort to seize Lockbit's operations, said the group "remains completely compromised".

"We recognised Lockbit would likely attempt to regroup and rebuild their systems. However, we have gathered a huge amount of intelligence about them and those associated to them, and our work to target and disrupt them continues," the NCA said on Monday.

The new Lockbit darkweb site showed a gallery of company names, each attached to a countdown clock marking the deadline within which that company was required to pay ransom.

"They want to scare me because they cannot find and eliminate me, I cannot be stopped," said the statement, which was presented as part of a mock-up leak from the FBI.

Last Tuesday the US announced it had charged two Russian citizens with deploying Lockbit ransomware against companies and groups around the world.

Police in Poland made an arrest while in Ukraine, local and French police arrested a father-son duo they said carried out attacks using Lockbit's malicious software.

The operation was widely seen by cybersecurity experts as designed to discredit Lockbit's standing amongst its "affiliates" - the criminal groups which use Lockbit's tools to carry out ransomware attacks.

Australian Associated Press