LockBit Mandiant ‘hack’ might be bid to distance gang from Evil Corp

Ransomware gang LockBit claims to have hacked safety vendor Mandiant, stealing greater than 350,000 information and threatening to leak them on-line. Mandiant says it has discovered “no proof” of a breach, and believes LockBit could also be placing again after Mandiant launched an investigation into its relationship to Russian cyber gang Evil Corp.

The claims emerged late final evening as LockBit revealed two information to its sufferer weblog on the darkish net which it claims stem from an assault on Mandiant. The group says it has extra knowledge to launch: “all obtainable info might be revealed!”, its weblog publish reads. It’s not identified if a ransom demand has been made to Mandiant, however a countdown timer on the publish seems to point that the deadline for the discharge of knowledge is approaching.

Who’re LockBit?

Previously often known as ABCD, LockBit is understood for requesting monetary cost from its victims in change for decryption of knowledge. “It focuses totally on enterprises and authorities organisations quite than people,” says a report from security vendor Kaspersky.

Lively since 2019, high-profile victims of the gang embody Accenture, the place LockBit demanded $50m in change for stolen knowledge final 12 months. Nevertheless, reviews famous that when a countdown timer arrange for cost of the ransom handed zero, no knowledge was launched.

The similarities between the Accenture ‘breach’ and this incident have made safety analysts suspicious. “This gang has made plenty of false claims prior to now,” stated Brett Callow, safety researcher at Emsisoft, including that it’s “solely potential” that the group’s claims about Mandiant have “no substance to them in any way”.

Has LockBit actually breached Mandiant?

Certainly Mandiant, which is presently within the technique of being acquired by Google for round $5.4bn, says it’s conscious of claims however has “discovered no proof” to again them up. “Based mostly on the information launched, there are not any indications that Mandiant knowledge was disclosed however quite the actor seems to be attempting to disprove Mandiant’s weblog on UNC2165 and LockBit,” the corporate stated.

Mandiant launched a report into LockBit and its relationship to the Russian cybercrime gang Evil Corp final week. The US authorities sanctioned Evil Corp members in 2019 as a part of a global sting operation, describing it as “one of many world’s most prolific cybercrime operations”. The brand new Mandiant report explains that it believes Evil Corp members at the moment are utilizing LockBit malware “to hinder attribution efforts in an effort to evade sanctions”.

Content material from our companions

LockBit was clearly irked by this affiliation, releasing an announcement declaring “Mandiant.com will not be skilled”, and including it “has nothing to do with Evil Corp”. It stated: “We’re actual underground darknet hackers, we’ve got nothing to do with politics or particular providers just like the FSB, FBI and so forth.”

This new alleged assault might be an additional try and discourage Mandiant from linking LockBit and Evil Corp says Xue Yin Peh, senior cyber risk intelligence analyst at Digital Shadows. “Its causes for the assault are more likely to be to keep away from the following scrutiny and a focus that will include being affiliated with a sanctioned cybercriminal group [Evil Corp],” she says.

Others consider the timing of the disturbance is important, as the worldwide cybersecurity convention RSA is getting underway in San Francisco. “Provided that it’s the second day of RSA, there could also be some type of advertising or publicity stunt driving this story,” argues Brian Higgins, safety specialist at Comparitech.

Learn extra: Ransomware in 2022: Larger and extra business-savvy