{"id":10661,"date":"2024-03-06T18:52:01","date_gmt":"2024-03-06T18:52:01","guid":{"rendered":"https:\/\/www.jumpsec.com\/?p=10661"},"modified":"2024-03-27T17:04:52","modified_gmt":"2024-03-27T17:04:52","slug":"lockbit-disrupted-ransomware-trends-update","status":"publish","type":"post","link":"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/","title":{"rendered":"Lockbit Disrupted: Ransomware Trends Update"},"content":{"rendered":"[vc_row type=&#8221;in_container&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; scene_position=&#8221;center&#8221; text_color=&#8221;dark&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overflow=&#8221;visible&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221;][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; column_element_direction_desktop=&#8221;default&#8221; column_element_spacing=&#8221;default&#8221; desktop_text_alignment=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_backdrop_filter=&#8221;none&#8221; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; column_position=&#8221;default&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/1&#8243; tablet_width_inherit=&#8221;default&#8221; animation_type=&#8221;default&#8221; bg_image_animation=&#8221;none&#8221; border_type=&#8221;simple&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221;][vc_column_text text_direction=&#8221;default&#8221;]Faced with year-on-year rising <a href=\"https:\/\/www.jumpsec.com\/uk-ransomware-trends-2023-mid-year-update\/\">attack figures<\/a>, law enforcement have struggled to adapt to the immense task of preventing ransomware and cyber extortion. By tracking and analysing attacker reported victim data, we seek to explore the significance of Lockbit\u2019s recent takedown in the context of prior disruption efforts.[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=&#8221;in_container&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; scene_position=&#8221;center&#8221; text_color=&#8221;dark&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overflow=&#8221;visible&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221;][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; column_element_direction_desktop=&#8221;default&#8221; column_element_spacing=&#8221;default&#8221; desktop_text_alignment=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_backdrop_filter=&#8221;none&#8221; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; column_position=&#8221;default&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/1&#8243; tablet_width_inherit=&#8221;default&#8221; animation_type=&#8221;default&#8221; bg_image_animation=&#8221;none&#8221; border_type=&#8221;simple&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221;][vc_column_text text_direction=&#8221;default&#8221;]\n<h3><strong>TL;DR<\/strong><\/h3>\n[\/vc_column_text]<div class=\"nectar-fancy-ul\" data-list-icon=\"fa fa-dot-circle-o\" data-animation=\"true\" data-animation-delay=\"0\" data-color=\"accent-color\" data-spacing=\"15px\" data-alignment=\"left\"> \n<ul>\n<li>On the 20th February 2024, Lockbit ransomware were disrupted by a bilateral law enforcement operation including the UK\u2019s NCA, the FBI and several international partners, reportedly via a critical PHP vulnerability.<\/li>\n<li><span style=\"font-weight: 400;\">According to JUMPSEC data, Lockbit accounts for an average of 26.2% of total victims globally (from 2021-present) making them the most prolific ransomware entity, having targeted over 2,000 victims and receiving an estimated ~$120M (<\/span><a href=\"https:\/\/www.justice.gov\/opa\/pr\/us-and-uk-disrupt-lockbit-ransomware-variant\"><span style=\"font-weight: 400;\">DoJ<\/span><\/a><span style=\"font-weight: 400;\">). <\/span><\/li>\n<li><span style=\"font-weight: 400;\">Unlike previous action to takedown REvil prior to the Ukraine invasion in 2022, the physical arrest of the group\u2019s Russian-based actors is no longer possible in the current geopolitical landscape.<\/span><\/li>\n<li><span style=\"font-weight: 400;\">However, authorities arrested two LockBit actors in Poland and Ukraine, issuing 8 warrants, seizing infrastructure, freezing 200 crypto accounts and developing open-source <\/span><a href=\"https:\/\/www.nomoreransom.org\/en\/decryption-tools.html\"><span style=\"font-weight: 400;\">decryption<\/span><\/a><span style=\"font-weight: 400;\"> tools to aid victims.\u00a0<\/span><\/li>\n<li><span style=\"font-weight: 400;\">This follows the arrest of two Lockbit affiliated threat actors in late 2022 and 2023.\u00a0<\/span><\/li>\n<li><span style=\"font-weight: 400;\">Authorities also publicly trolled the largest ransomware group to date and damaged their reputation, breeding doubt into their network and potentially affecting Lockbit\u2019s affiliate actor recruitment power.<\/span><\/li>\n<\/ul>\n <\/div>[\/vc_column][\/vc_row][vc_row type=&#8221;in_container&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; scene_position=&#8221;center&#8221; text_color=&#8221;dark&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overflow=&#8221;visible&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221;][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; column_element_direction_desktop=&#8221;default&#8221; column_element_spacing=&#8221;default&#8221; desktop_text_alignment=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_backdrop_filter=&#8221;none&#8221; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; column_position=&#8221;default&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/1&#8243; tablet_width_inherit=&#8221;default&#8221; animation_type=&#8221;default&#8221; bg_image_animation=&#8221;none&#8221; border_type=&#8221;simple&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221;][vc_column_text text_direction=&#8221;default&#8221;]\n<h3><strong>Disruption in context: How do Lockbit compare?<\/strong><\/h3>\n[\/vc_column_text][vc_column_text text_direction=&#8221;default&#8221;]With many speculating on what will happen next, here\u2019s a timeline of the historical data from previous instances where ransomware groups of a comparable size to Lockbit were shut down or disbanded, running from 2021 to March 2024..[\/vc_column_text][image_with_animation image_url=&#8221;10662&#8243; image_size=&#8221;full&#8221; animation_type=&#8221;entrance&#8221; animation=&#8221;None&#8221; animation_movement_type=&#8221;transform_y&#8221; hover_animation=&#8221;none&#8221; alignment=&#8221;&#8221; border_radius=&#8221;none&#8221; box_shadow=&#8221;none&#8221; image_loading=&#8221;default&#8221; max_width=&#8221;100%&#8221; max_width_mobile=&#8221;default&#8221;][vc_column_text text_direction=&#8221;default&#8221;]<span style=\"color: #df0a34;\"><strong>Above: Lockbit&#8217;s proportionate share of global victims has been significant at ~26.2%. The total number of ransomware victims globally (grey), along with the monthly victims of the major ransomware groups (Lockbit, Conti, Hive and REvil) that <\/strong><\/span><strong style=\"color: #df0a34;\">have now been disrupted or disbanded<\/strong><strong style=\"color: #df0a34;\">, 2021-2024.\u00a0<\/strong>[\/vc_column_text][vc_column_text text_direction=&#8221;default&#8221;]If ongoing attempts by Lockbit to re-start operations are ineffective or their presence naturally diminishes, emerging or less prolific competitors could capitalise by recruiting additional technical resources and affiliates still keen to profit from ransomware.[\/vc_column_text][image_with_animation image_url=&#8221;10676&#8243; image_size=&#8221;full&#8221; animation_type=&#8221;entrance&#8221; animation=&#8221;None&#8221; animation_movement_type=&#8221;transform_y&#8221; hover_animation=&#8221;none&#8221; alignment=&#8221;&#8221; border_radius=&#8221;none&#8221; box_shadow=&#8221;none&#8221; image_loading=&#8221;default&#8221; max_width=&#8221;100%&#8221; max_width_mobile=&#8221;default&#8221;][vc_column_text text_direction=&#8221;default&#8221;]<span style=\"color: #df0a34;\"><strong>Above: The most prevalent threat actors so far in 2024. As we have seen previously, as one group dissolves or diminishes, others may rise (i.e connected groups Conti. Karakurt, Royal, or REvil and BlackCat).\u00a0<\/strong><\/span>[\/vc_column_text][vc_column_text text_direction=&#8221;default&#8221;]Each major ransomware takedown has provided a unique insight into threat group disruption. Below we breakdown the REvil, Conti, Hive and Lockbit disruptions.[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=&#8221;in_container&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; scene_position=&#8221;center&#8221; text_color=&#8221;dark&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overflow=&#8221;visible&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221;][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; column_element_direction_desktop=&#8221;default&#8221; column_element_spacing=&#8221;default&#8221; desktop_text_alignment=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_backdrop_filter=&#8221;none&#8221; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; column_position=&#8221;default&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/1&#8243; tablet_width_inherit=&#8221;default&#8221; animation_type=&#8221;default&#8221; bg_image_animation=&#8221;none&#8221; border_type=&#8221;simple&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221;][vc_column_text text_direction=&#8221;default&#8221;]\n<h3><strong>REvil\/Sodinokibi<\/strong> (October 2021)<\/h3>\n[\/vc_column_text][vc_column_text text_direction=&#8221;default&#8221;]One of the most notorious ransomware groups, REvil, had their servers compromised and were forced offline in a bilateral law enforcement operation in October 2021 before being aggressively arrested by authorities in a suspicious show trial-esque Russian police raid in January 2022 prior to the invasion of Ukraine. Whatever its true significance, the potential for Russian threat actors to face physical consequences is now next to impossible.[\/vc_column_text][image_with_animation image_url=&#8221;10664&#8243; image_size=&#8221;full&#8221; animation_type=&#8221;entrance&#8221; animation=&#8221;None&#8221; animation_movement_type=&#8221;transform_y&#8221; hover_animation=&#8221;none&#8221; alignment=&#8221;&#8221; border_radius=&#8221;none&#8221; box_shadow=&#8221;none&#8221; image_loading=&#8221;default&#8221; max_width=&#8221;100%&#8221; max_width_mobile=&#8221;default&#8221;][vc_column_text text_direction=&#8221;default&#8221;]<span style=\"color: #df0a34;\"><strong>Despite disappearing as \u2018REvil\u2019, potentially connected groups such as BlackCat continued to grow. So too have Karakurt, Royal and Akira after Conti\u2019s dissolution (connections based on aligned TTPs and reputable CTI).\u00a0<\/strong><\/span>[\/vc_column_text][\/vc_column][\/vc_row][vc_row type=&#8221;in_container&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; scene_position=&#8221;center&#8221; text_color=&#8221;dark&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overflow=&#8221;visible&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221;][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; column_element_direction_desktop=&#8221;default&#8221; column_element_spacing=&#8221;default&#8221; desktop_text_alignment=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_backdrop_filter=&#8221;none&#8221; column_shadow=&#8221;none&#8221; column_border_radius=&#8221;none&#8221; column_link_target=&#8221;_self&#8221; column_position=&#8221;default&#8221; gradient_direction=&#8221;left_to_right&#8221; overlay_strength=&#8221;0.3&#8243; width=&#8221;1\/1&#8243; tablet_width_inherit=&#8221;default&#8221; animation_type=&#8221;default&#8221; bg_image_animation=&#8221;none&#8221; border_type=&#8221;simple&#8221; column_border_width=&#8221;none&#8221; column_border_style=&#8221;solid&#8221;][vc_column_text text_direction=&#8221;default&#8221;]\n<h3><strong>Conti <\/strong>(May 2022)<\/h3>\n[\/vc_column_text][vc_column_text text_direction=&#8221;default&#8221;]Conti were one of the few groups to have a comparable impact as Lockbit, with an average of 17% of global total victims during its lifespan. Conti increasingly targeted high-risk targets (i.e the Costa Rican Government) and the group&#8217;s dissolution was ultimately due to increasing law enforcement pressure and in-fighting between Russian and Ukrainian members surrounding national allegiances in late February 2022.[\/vc_column_text][image_with_animation image_url=&#8221;10668&#8243; image_size=&#8221;full&#8221; animation_type=&#8221;entrance&#8221; animation=&#8221;None&#8221; animation_movement_type=&#8221;transform_y&#8221; hover_animation=&#8221;none&#8221; alignment=&#8221;&#8221; border_radius=&#8221;none&#8221; box_shadow=&#8221;none&#8221; image_loading=&#8221;default&#8221; max_width=&#8221;100%&#8221; max_width_mobile=&#8221;default&#8221;][vc_column_text text_direction=&#8221;default&#8221;]<span style=\"color: #df0a34;\"><strong>Like REvil, following Conti\u2019s dissolution, Karakurt, Royal and Akira <\/strong><\/span><strong style=\"color: #df0a34;\">emerged as more prolific entities. There is evidence to suggest that these groups were <\/strong><strong style=\"color: #df0a34;\">connected with Conti members based on aligned TTPs and available CTI.<\/strong>[\/vc_column_text][vc_column_text text_direction=&#8221;default&#8221;]\n<h3><strong>Hive <\/strong>(January 2023)<\/h3>\n[\/vc_column_text][vc_column_text text_direction=&#8221;default&#8221;]The takedown of Hive ransomware encompassed a bilateral law enforcement operation saw several US and European crime agencies collaborating to infiltrate Hive\u2019s infrastructure, distributing decryption keys, and thwarting a reported $130million in ransom payments.<\/p>\n<p>Requiring the concerted effort of several national crime agencies over a six-month period, the takedown demonstrated the scale of the challenge in tackling ransomware groups directly, as the relatively small ransomware group was a drop in the ocean of total attack figures. That said, official statements that announced the operation as a &#8216;model for future success&#8217; have aged well.[\/vc_column_text][vc_column_text]\n<h3>Conclusion<\/h3>\n[\/vc_column_text][vc_column_text text_direction=&#8221;default&#8221;]Ultimately, while the cynics may correctly point out that previous takedowns have not seriously impacted the long-term rise of total ransomware victims, the disruption caused by the NCA, FBI and other law enforcement agencies should be acknowledged as a major win. Beyond the display of technical prowess and the limiting of Lockbit&#8217;s capabilities, by posting the NCA and FBI logos on Lockbit&#8217;s site and setting a timer threatening to reveal the admin&#8217;s identify, authorities are playing the threat actors at their own game.<\/p>\n<p>Hopefully, the fact that authorities are confident enough to ironically troll the most significant ransomware group to date is a signal that international law enforcement have developed the technical capacity and cohesion to seriously disrupt more advanced and sustained ransomware threats. Equally, one can only hope that Lockbit, who continue to operate, are unable to seek significant retaliation for the authorities&#8217; experimental tactics.<\/p>\n<p>While Lockbit are still posting victims at a similarly high volume, time will tell how effective recent disruptions efforts have been.[\/vc_column_text][\/vc_column][\/vc_row]\n","protected":false},"excerpt":{"rendered":"<p>[vc_row type=&#8221;in_container&#8221; full_screen_row_position=&#8221;middle&#8221; column_margin=&#8221;default&#8221; column_direction=&#8221;default&#8221; column_direction_tablet=&#8221;default&#8221; column_direction_phone=&#8221;default&#8221; scene_position=&#8221;center&#8221; text_color=&#8221;dark&#8221; text_align=&#8221;left&#8221; row_border_radius=&#8221;none&#8221; row_border_radius_applies=&#8221;bg&#8221; overflow=&#8221;visible&#8221; overlay_strength=&#8221;0.3&#8243; gradient_direction=&#8221;left_to_right&#8221; shape_divider_position=&#8221;bottom&#8221; bg_image_animation=&#8221;none&#8221;][vc_column column_padding=&#8221;no-extra-padding&#8221; column_padding_tablet=&#8221;inherit&#8221; column_padding_phone=&#8221;inherit&#8221; column_padding_position=&#8221;all&#8221; column_element_direction_desktop=&#8221;default&#8221; column_element_spacing=&#8221;default&#8221; desktop_text_alignment=&#8221;default&#8221; tablet_text_alignment=&#8221;default&#8221; phone_text_alignment=&#8221;default&#8221; background_color_opacity=&#8221;1&#8243; background_hover_color_opacity=&#8221;1&#8243; column_backdrop_filter=&#8221;none&#8221; column_shadow=&#8221;none&#8221;&#8230;<\/p>\n","protected":false},"author":8,"featured_media":10731,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,22],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Lockbit-disrupted-ransomware-trends-update | JUMPSEC<\/title>\n<meta name=\"description\" content=\"Faced with year-on-year rising attack figures, law enforcement have struggled to adapt to the immense task of preventing ransomware and cyber extortion. Read the JUMPSEC analysis here &gt;&gt;\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Lockbit-disrupted-ransomware-trends-update | JUMPSEC\" \/>\n<meta property=\"og:description\" content=\"Faced with year-on-year rising attack figures, law enforcement have struggled to adapt to the immense task of preventing ransomware and cyber extortion. Read the JUMPSEC analysis here &gt;&gt;\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/\" \/>\n<meta property=\"og:site_name\" content=\"JUMPSEC\" \/>\n<meta property=\"article:published_time\" content=\"2024-03-06T18:52:01+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-03-27T17:04:52+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.jumpsec.com\/wp-content\/uploads\/2024\/03\/Lockbit-Disrupted-Ransomware-Trends-Update.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"800\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Sean Moran\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@JUMPSEC\" \/>\n<meta name=\"twitter:site\" content=\"@JUMPSEC\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Sean Moran\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/\"},\"author\":{\"name\":\"Sean Moran\",\"@id\":\"https:\/\/www.jumpsec.com\/#\/schema\/person\/d9c29b3ddc88fb4d0aecd58bc8a86343\"},\"headline\":\"Lockbit Disrupted: Ransomware Trends Update\",\"datePublished\":\"2024-03-06T18:52:01+00:00\",\"dateModified\":\"2024-03-27T17:04:52+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/\"},\"wordCount\":1968,\"publisher\":{\"@id\":\"https:\/\/www.jumpsec.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.jumpsec.com\/wp-content\/uploads\/2024\/03\/Lockbit-Disrupted-Ransomware-Trends-Update.webp\",\"articleSection\":[\"Insights\",\"Ransomware\"],\"inLanguage\":\"en-GB\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/\",\"url\":\"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/\",\"name\":\"Lockbit-disrupted-ransomware-trends-update | JUMPSEC\",\"isPartOf\":{\"@id\":\"https:\/\/www.jumpsec.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.jumpsec.com\/wp-content\/uploads\/2024\/03\/Lockbit-Disrupted-Ransomware-Trends-Update.webp\",\"datePublished\":\"2024-03-06T18:52:01+00:00\",\"dateModified\":\"2024-03-27T17:04:52+00:00\",\"description\":\"Faced with year-on-year rising attack figures, law enforcement have struggled to adapt to the immense task of preventing ransomware and cyber extortion. Read the JUMPSEC analysis here >>\",\"breadcrumb\":{\"@id\":\"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/#breadcrumb\"},\"inLanguage\":\"en-GB\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/#primaryimage\",\"url\":\"https:\/\/www.jumpsec.com\/wp-content\/uploads\/2024\/03\/Lockbit-Disrupted-Ransomware-Trends-Update.webp\",\"contentUrl\":\"https:\/\/www.jumpsec.com\/wp-content\/uploads\/2024\/03\/Lockbit-Disrupted-Ransomware-Trends-Update.webp\",\"width\":1200,\"height\":800,\"caption\":\"Lockbit Disrupted- Ransomware Trends Update\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.jumpsec.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Lockbit Disrupted: Ransomware Trends Update\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.jumpsec.com\/#website\",\"url\":\"https:\/\/www.jumpsec.com\/\",\"name\":\"JUMPSEC\",\"description\":\"Enabling Effective Cyber Security.\",\"publisher\":{\"@id\":\"https:\/\/www.jumpsec.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.jumpsec.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-GB\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.jumpsec.com\/#organization\",\"name\":\"Jumpsec\",\"url\":\"https:\/\/www.jumpsec.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.jumpsec.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.jumpsec.com\/wp-content\/uploads\/2022\/08\/JUMPSEC-2021-Retina.png\",\"contentUrl\":\"https:\/\/www.jumpsec.com\/wp-content\/uploads\/2022\/08\/JUMPSEC-2021-Retina.png\",\"width\":300,\"height\":56,\"caption\":\"Jumpsec\"},\"image\":{\"@id\":\"https:\/\/www.jumpsec.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/JUMPSEC\",\"https:\/\/www.youtube.com\/channel\/UCpwVvJpDfFzBClzGhLUAZBw\",\"https:\/\/www.linkedin.com\/company\/jumpsec\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.jumpsec.com\/#\/schema\/person\/d9c29b3ddc88fb4d0aecd58bc8a86343\",\"name\":\"Sean Moran\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-GB\",\"@id\":\"https:\/\/www.jumpsec.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/e5b75bb0a8a5ef8b8603d4d0d088dd4a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/e5b75bb0a8a5ef8b8603d4d0d088dd4a?s=96&d=mm&r=g\",\"caption\":\"Sean Moran\"},\"url\":\"https:\/\/www.jumpsec.com\/guides\/author\/sean\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Lockbit-disrupted-ransomware-trends-update | JUMPSEC","description":"Faced with year-on-year rising attack figures, law enforcement have struggled to adapt to the immense task of preventing ransomware and cyber extortion. Read the JUMPSEC analysis here >>","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/","og_locale":"en_GB","og_type":"article","og_title":"Lockbit-disrupted-ransomware-trends-update | JUMPSEC","og_description":"Faced with year-on-year rising attack figures, law enforcement have struggled to adapt to the immense task of preventing ransomware and cyber extortion. Read the JUMPSEC analysis here >>","og_url":"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/","og_site_name":"JUMPSEC","article_published_time":"2024-03-06T18:52:01+00:00","article_modified_time":"2024-03-27T17:04:52+00:00","og_image":[{"width":1200,"height":800,"url":"https:\/\/www.jumpsec.com\/wp-content\/uploads\/2024\/03\/Lockbit-Disrupted-Ransomware-Trends-Update.webp","type":"image\/webp"}],"author":"Sean Moran","twitter_card":"summary_large_image","twitter_creator":"@JUMPSEC","twitter_site":"@JUMPSEC","twitter_misc":{"Written by":"Sean Moran","Estimated reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/#article","isPartOf":{"@id":"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/"},"author":{"name":"Sean Moran","@id":"https:\/\/www.jumpsec.com\/#\/schema\/person\/d9c29b3ddc88fb4d0aecd58bc8a86343"},"headline":"Lockbit Disrupted: Ransomware Trends Update","datePublished":"2024-03-06T18:52:01+00:00","dateModified":"2024-03-27T17:04:52+00:00","mainEntityOfPage":{"@id":"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/"},"wordCount":1968,"publisher":{"@id":"https:\/\/www.jumpsec.com\/#organization"},"image":{"@id":"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/#primaryimage"},"thumbnailUrl":"https:\/\/www.jumpsec.com\/wp-content\/uploads\/2024\/03\/Lockbit-Disrupted-Ransomware-Trends-Update.webp","articleSection":["Insights","Ransomware"],"inLanguage":"en-GB"},{"@type":"WebPage","@id":"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/","url":"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/","name":"Lockbit-disrupted-ransomware-trends-update | JUMPSEC","isPartOf":{"@id":"https:\/\/www.jumpsec.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/#primaryimage"},"image":{"@id":"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/#primaryimage"},"thumbnailUrl":"https:\/\/www.jumpsec.com\/wp-content\/uploads\/2024\/03\/Lockbit-Disrupted-Ransomware-Trends-Update.webp","datePublished":"2024-03-06T18:52:01+00:00","dateModified":"2024-03-27T17:04:52+00:00","description":"Faced with year-on-year rising attack figures, law enforcement have struggled to adapt to the immense task of preventing ransomware and cyber extortion. Read the JUMPSEC analysis here >>","breadcrumb":{"@id":"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/#primaryimage","url":"https:\/\/www.jumpsec.com\/wp-content\/uploads\/2024\/03\/Lockbit-Disrupted-Ransomware-Trends-Update.webp","contentUrl":"https:\/\/www.jumpsec.com\/wp-content\/uploads\/2024\/03\/Lockbit-Disrupted-Ransomware-Trends-Update.webp","width":1200,"height":800,"caption":"Lockbit Disrupted- Ransomware Trends Update"},{"@type":"BreadcrumbList","@id":"https:\/\/www.jumpsec.com\/guides\/lockbit-disrupted-ransomware-trends-update\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.jumpsec.com\/"},{"@type":"ListItem","position":2,"name":"Lockbit Disrupted: Ransomware Trends Update"}]},{"@type":"WebSite","@id":"https:\/\/www.jumpsec.com\/#website","url":"https:\/\/www.jumpsec.com\/","name":"JUMPSEC","description":"Enabling Effective Cyber Security.","publisher":{"@id":"https:\/\/www.jumpsec.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.jumpsec.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-GB"},{"@type":"Organization","@id":"https:\/\/www.jumpsec.com\/#organization","name":"Jumpsec","url":"https:\/\/www.jumpsec.com\/","logo":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.jumpsec.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.jumpsec.com\/wp-content\/uploads\/2022\/08\/JUMPSEC-2021-Retina.png","contentUrl":"https:\/\/www.jumpsec.com\/wp-content\/uploads\/2022\/08\/JUMPSEC-2021-Retina.png","width":300,"height":56,"caption":"Jumpsec"},"image":{"@id":"https:\/\/www.jumpsec.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/JUMPSEC","https:\/\/www.youtube.com\/channel\/UCpwVvJpDfFzBClzGhLUAZBw","https:\/\/www.linkedin.com\/company\/jumpsec\/"]},{"@type":"Person","@id":"https:\/\/www.jumpsec.com\/#\/schema\/person\/d9c29b3ddc88fb4d0aecd58bc8a86343","name":"Sean Moran","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.jumpsec.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/e5b75bb0a8a5ef8b8603d4d0d088dd4a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/e5b75bb0a8a5ef8b8603d4d0d088dd4a?s=96&d=mm&r=g","caption":"Sean Moran"},"url":"https:\/\/www.jumpsec.com\/guides\/author\/sean\/"}]}},"_links":{"self":[{"href":"https:\/\/www.jumpsec.com\/wp-json\/wp\/v2\/posts\/10661"}],"collection":[{"href":"https:\/\/www.jumpsec.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.jumpsec.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.jumpsec.com\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/www.jumpsec.com\/wp-json\/wp\/v2\/comments?post=10661"}],"version-history":[{"count":47,"href":"https:\/\/www.jumpsec.com\/wp-json\/wp\/v2\/posts\/10661\/revisions"}],"predecessor-version":[{"id":10908,"href":"https:\/\/www.jumpsec.com\/wp-json\/wp\/v2\/posts\/10661\/revisions\/10908"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.jumpsec.com\/wp-json\/wp\/v2\/media\/10731"}],"wp:attachment":[{"href":"https:\/\/www.jumpsec.com\/wp-json\/wp\/v2\/media?parent=10661"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.jumpsec.com\/wp-json\/wp\/v2\/categories?post=10661"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.jumpsec.com\/wp-json\/wp\/v2\/tags?post=10661"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}