The Impact of LockBits New ContiBased Encryptor on Ransomware

The LockBit ransomware gang has recently started using a new encryptor, called LockBit Green, which is based on the source code of the now-defunct Conti ransomware gang. This follows the gang's previous iterations of their encryptor, which began with a custom one and progressed to LockBit 3.0, which was based on the source code of the BlackMatter gang. Researchers have discovered samples of the new encryptor circulating on VirusTotal and other malware-sharing websites. LockBit has modified only a small part of the source code, including the ransom note, which is identical to that used by LockBit Black. By reusing and adapting the source code of reputable competitors, such as Conti, ransomware-as-a-service (RaaS) maintainers can maximize their release speed to attract new affiliates. Researchers from Prodaft have shared Indicators of Compromise for Lockbit Green along with the Yara rule for detecting its patterns. It is still unclear why LockBit is using a new Conti-based encryptor when their previous one is still operational, but PRODAFT may have the answer. The LockBit ransomware gang has recently resumed using encryptors based on other operations, switching to one based on the Conti ransomware's leaked source code. This new encryptor, called LockBit Green, has been found circulating on VirusTotal and other malware-sharing websites. LockBit has modified only a small part of the source code, including the ransom note, which is identical to that used by LockBit Black. By reusing and adapting the source code of reputable competitors, such as Conti, ransomware-as-a-service (RaaS) maintainers can maximize their release speed to attract new affiliates. Researchers from Prodaft have shared Indicators of Compromise for Lockbit Green along with the Yara rule for detecting its patterns. It is still unknown why LockBit is using a new Conti-based encryptor when their previous one is still operational, but PRODAFT may have the answer.

This Cyber News was published on heimdalsecurity.com. Publication date: Fri, 03 Feb 2023 11:52:02 +0000