Hack me if you can: LockBit challenges authorities, promises to return

“I didn’t pay a lot consideration to it, as a result of for five years of swimming in cash I turned very lazy,” LockBitSupp stated. “At 20:47 I discovered that the location provides a brand new error 404 Not Discovered nginx, tried to enter the server by SSH and couldn’t, the password didn’t match, because it turned out later all the data on the disks was erased.”

The observe additional defined that the hacked servers ran PHP model 8.1.2, which is affected by a distant code execution (RCE) enabling flaw CVE-2023-3824, which probably allowed the authorities to achieve entry to LockBit’s programs.

“The model put in on my servers was already recognized to have a recognized vulnerability, so that is almost definitely how the victims’ admin and chat panel servers and the weblog server have been accessed,” LockBitSupp added, mentioning that new LockBit servers are actually working the newest model of PHP 8.3.3.

All different servers that didn’t have PHP put in are unaffected and can proceed to present out information stolen from the attacked firms, the observe added.

LockBit to make some infrastructure changes

Within the seizure, worldwide legislation enforcement took over lots of LockBit’s leak websites, 34 of its servers spanning these in america, the UK, the Netherlands, Germany, Finland, France, Switzerland, and Australia, 200 cryptocurrency accounts, and 14,400 rogue e mail accounts.

Moreover, the authorities had collected about 1000 decryption keys, which the observe claims have been obtained from “unprotected decryptors,” and characterize merely 2.5% of the full variety of decryptors LockBit issued inside 5 years of its operations. Although dangerous, it isn’t deadly to its operations, LockBitSupp added.