Behind Enemy Lines: Going Undercover to Breach LockBit Ransomware Op
Inside account of a two-year undercover operation infiltrating the LockBit ransomware syndicate and profiling its leadership.
Summary
Infiltrating LockBit RaaS Operations
Delve into the clandestine world of the LockBit ransomware gang! In this revealing presentation, I will recount my two-year journey spent infiltrating the inner ranks of the LockBit crime syndicate. Learn about the strategies employed to earn the trust of key individuals within the syndicate, including the gang's leader, LockBitSupp.
Earning Trust and Interacting with LockBitSupp
You will see firsthand accounts of these exchanges, and I will detail the intricacies of my relationship with LockBit's leadership and its network of affiliate hackers. You will also gain insight into the unintended consequences of my actions, including how my perceived breach of their infrastructure impacted the syndicate's operations. More importantly, I will share how I assisted in unmasking the real-world person behind the mask of LockBitSupp.
Syndicate Infrastructure and Human Vulnerabilities
Join me as I illustrate the pivotal role of human intelligence in tandem with cyber threat intelligence to combat ransomware threats. This talk offers a compelling narrative of real-world efforts to thwart ransomware activities and safeguard organizations from LockBit ransomware attacks.
60 min (full episode): 4/14/2024: Scattered Spider; Knife; Tasmanian Tiger - CBS News 60 Min Overtime (additional footage from my interview about LockBit): Infiltrating ransomware gangs on the dark web - CBS News Ransomware Diaries Ransomware Diaries: Volume 1 | Analyst1 Ransomware Diaries V. 2: A Ransomware Hacker Origin Story (analyst1.com) Ransomware Diaries V. 3: LockBit's Secrets (analyst1.com) Ransomware Diaries Volume 5: Unmasking LockBit (analyst1.com)
Related talks
Main Stage·39 min
Vangelis Stykas
Vulnerabilities and offensive disruption techniques targeting the web management panels of active ransomware operations.
Main Stage·44 min
Maxime Bergeron · Olivier Bilodeau
Gozint and ESET researchers use PyRDP to record and classify over 100 hours of attacker sessions on exposed RDP honeypots into behavioral archetypes.
SLEUTHCON·13 min
Presenters detail vulnerability discovery and exploitation in BRUNCHCON 2022 (now SLEUTHCON) - The De-RaaS’ing of Ransomware.


