Media Coverage

"The actor came across as someone who was 'too big to fail' and even showed disdain to the arbitrator who would make the decision on the outcome of the claim," Trend Micro said. "This discourse demonstrated that LockBitSupp is likely using their reputation to carry more weight when negotiating payment for access or the share of ransom payouts with affiliates."

Japanese cybersecurity firm Trend Micro, which also took part in Operation Cronos, released a report on February 22 showing that the LockBit group was already trying to develop a new ransomware version.

In its own research this week, cybersecurity firm Trend Micro wrote that while LockBit has been a dominant ransomware variant, the group behind the malware had been running into a range of “logistical, technical, and reputational problems,” and this was before the law enforcement operation against it.

The ransomware operation was working on the "next-generation" crypto-locking malware, dubbed LockBit-NG-Dev, "which could be an upcoming version the group might consider as a true 4.0 version once complete," Trend Micro said.

As a result of the collaboration with the National Crime Agency in the UK, cybersecurity company Trend Micro analyzed a sample of the latest LockBit development that can work on multiple operating systems.

As part of the daily LockBit leaks this week, Trend Micro's report on the group, published today, analyzed a cross-platform version researchers believe was being designed to succeed the most recent LockBit 3.0 iteration.

The Trend Micro Zero Day Initiative (ZDI) has recently unearthed a critical vulnerability, identified as CVE-2024-21412, which they’ve dubbed ZDI-CAN-23100.

Researchers with Trend Micro’s Zero Day Initiative (ZDI) were among those who discovered the flaw. In a Feb. 13 post, they said it was exploited by the DarkCasino threat group (also known as Water Hydra) in a campaign targeting financial traders.

One of the zero-day vulnerabilities patched by Microsoft with its latest Patch Tuesday updates has been exploited in attacks aimed at financial market traders by a threat group tracked as Water Hydra and DarkCasino, according to Trend Micro.

Trend Micro, which began tracking the campaign in late December 2023, said it entails the exploitation of CVE-2024-21412, a security bypass vulnerability related to Internet Shortcut Files (.URL).