"The exposure of Evil Corp's ties to LockBit is a major blow to the ransomware affiliate market," said Ferhat Dikbiyik, head of research at Black Kite, in an emailed statement to Dark Reading. In addition, Aleksandr Ryzhenkov (aka Beverley), who was once second-in-command for the infamous Evil Corp cybercrime organization, was sanctioned and named as an affiliate for LockBit, indicating ties between the two groups. A global operation cuffed four LockBit suspects and offered more details into the org chart of Russia's infamous Evil Corp cybercrime gang. Russia-based Evil Corp, the outfit behind the Zeus and Dridex banking Trojans, largely disappeared from the cybercrime scene following US sanctions in 2019, which included the outing of Yakubets, his relationship with an FSB agent who is his father-in-law, and the exposure of Evil Corp's inner workings. In another phase of Operation Cronos, Europol and Eurojust have taken more action against the LockBit ransomware gang by making four arrests and seizing devices used as part of the ransomware's infrastructure. However, the Japanese Police, National Crime Agency, and FBI are focusing their expertise on developing decryption tools to recover files encrypted and lost to LockBit ransomware, according to Europol. The arrests were of a suspected developer for the group in France; two LockBit affiliates apprehended by the British authorities; and a bulletproof hosting service administrator cuffed by Spanish police, which also confiscated nine servers. Meanwhile, the US, the UK, and Australia imposed sanctions against Ryzhenkov, who the UK's National Crime Agency identified as a top lieutenant to Evil Corp leader Maxim Yakubets. LockBit ransomware has been deployed across a variety of sectors, including financial service, food and agriculture, education, energy, government and emergency services, and healthcare, among others. Copyright © 2024 Informa PLC Informa UK Limited is a company registered in England and Wales with company number 1072954 whose registered office is 5 Howick Place, London, SW1P 1WG. According to the NCA, Ryzhenkov was key to the development of Evil Corp's post-sanctions WastedLocker ransomware, which was a ransomware-as-a-service (RaaS) offering circulating in 2020. Meanwhile, LockBit has denied having any working relationship with Evil Corp.
This Cyber News was published on www.darkreading.com. Publication date: Tue, 01 Oct 2024 20:35:11 +0000