uTalk

Nowadays, LockBit ransomware is the most dynamic and successful cybercrime structure in the world. LockBit is attributed to a Russian threat actor and emerged from the shadow of the Conti ransomware group, which disbanded in early 2022.

LockBit ransomware was first detected in September 2019 and was previously known as ABCD ransomware due to the ".abcd virus" extension which was first observed. LockBit operates on a ransomware-as-a-service (RaaS) model. In a nutshell, this means that affiliates make a deposit to use the tool and then split the ransom payment with the LockBit group. It has been reported that some affiliates receive up to 75% share. The operators of LockBit have posted advertisements for their affiliate program on Russian-language crime forums stating that they will not operate in Russia or the CIS countries, nor work with English-speaking developers unless a Russian-speaking "voucher" vouches for them.
Initial attack vectors of LockBit include social engineering, such as phishing, spear phishing, and business email compromise (BEC), exploiting public-facing applications, hiring initial access brokers" (IABs), and using stolen credentials to access valid accounts, such as remote desktop protocol (RDP), as well as brute-force cracking attacks.

During last year's Global Threat Forecast webinar, hosted by SecurityHQ, we identified LockBit as a significant threat and highlighted them as a Threat Actor to pay close attention to during 2022.

LockBit Targets#
LockBit has typically focused attacks on government entities and enterprises in a variety of sectors, such as healthcare, financial services, and industrial goods and services. The ransomware has been observed targeting countries globally, including the US, China, India, Indonesia, Ukraine, France, the UK, and Germany.

Another interesting feature of LockBit is that it is programmed in a way that it cannot be used in attacks against Russia or CIS countries (Commonwealth of Independent States). This is likely a precautionary measure taken by the group to avoid any potential backlash from the Russian government.

Threat actors have been increasingly observed using AI-generated YouTube Videos to spread a variety of stealer malware such as Raccoon, RedLine, and Vidar.
"The videos lure users by pretending to be tutorials on how to download cracked versions of software such as Photoshop, Premiere Pro, Autodesk 3ds Max, AutoCAD, and other products that are licensed products available only to paid users," CloudSEK researcher Pavan Karthick M said.
Just as the ransomware landscape comprises core developers and affiliates who are in charge of identifying potential targets and actually carrying out the attacks, the information stealer ecosystem also consists of threat actors known as traffers who are recruited to spread the malware using different methods.
One of the popular malware distribution channels is YouTube, with CloudSEK witnessing a 200-300% month-over-month increase in videos containing links to stealer malware in the description section.
These links are often obfuscated using URL shorteners like Bitly and Cuttly, or alternatively hosted on MediaFire, Google Drive, Discord, GitHub, and Telegram's Telegraph.

In several instances, threat actors leverage data leaks and social engineering to hijack legitimate YouTube accounts and push malware, often targeting popular accounts to reach a large audience in a short span of time.

"Uploading to such accounts lends video legitimacy as well," Karthick explained. "However, such Youtubers will report their account taker to YouTube and gain access back to their accounts within a few hours. But in a few hours, hundreds of users could have fallen prey."

More ominously, anywhere between five to 10 crack download videos are uploaded to the video platform every hour, with the threat actors employing search engine optimization (SEO) poisoning techniques to make the videos appear at the top of the list.

Threat actors have also been observed to add fake comments to the uploaded videos to further mislead and entice users into downloading the cracked software.

The development comes amid a surge in new information stealer variants like SYS01stealer, S1deload, Stealc, Titan, ImBetter, WhiteSnake, and Lumma that are offered for sale and come with capabilities to plunder sensitive data under the guise of popular apps and services.

The findings also follow the discovery of a ready-to-use toolkit called R3NIN Sniffer that can enable threat actors to siphon payment card data from compromised e-commerce websites.

To mitigate risks posed by stealer malware, users are recommended to enable multi-factor authentication, refrain from clicking on unknown links, and avoid downloading or using pirated software.