LockBit Implements New Technique By Leaking Victim Negotiations

While many ransomware groups come and go, LockBit seems to be the one that persists. First discovered in September 2019 using the name ABCD, and then gaining notoriety as LockBit in April 2020, the group has outlasted many of their competitors.¹ This is in part due to the innovation in the group's tactics, techniques, and procedures (TTPs), as well as the group's collective beliefs. An example of this is a decision made in relation to the Russia and Ukraine conflict. While groups such as Conti expressed their support for Russia during their invasion of Ukraine, and was subsequently hacked by a pro-Ukraine individual, LockBit took a different stance. In an official statement, LockBit made their political affiliation clear: "For us it is just business, and we are all apolitical. We are only interested in money for our harmless and useful work."² This has also allowed them to skirt various regulations. By not claiming allegiance to one government, LockBit has not been