LockBit Ransomware Infrastructure Compromised: Internal Communications and Operational Data Exposed

The LockBit ransomware operation, responsible for extorting over $120 million from global victims, has suffered an unprecedented breach of its own infrastructure. On May 7, 2025, attackers compromised LockBit’s dark web leak sites, exposing internal chat logs, affiliate details, and operational data—a significant blow to one of the world’s most prolific cybercriminal enterprises¹.

Operational Impact and Exposed Data

The breach revealed critical insights into LockBit’s Ransomware-as-a-Service (RaaS) model, where affiliates receive 75-80% of ransom profits². Exposed chat logs show discussions about target selection, payment negotiations, and technical issues with their custom StealBit data exfiltration tool. Forensic analysis indicates the attackers exploited a PHP vulnerability (CVE-2023-3824) to gain access to LockBit’s administrative panels³.

Technical artifacts from the leak include:

LockBit 3.0 builder scripts with hardcoded C2 IPs
Affiliate payment records showing Bitcoin transactions
Unreleased LockBit Green variant test builds for macOS/Linux

Historical Context and Evolution

LockBit has dominated the ransomware landscape since 2019, accounting for 22.22% of global incidents in 2023⁴. The operation evolved through four major versions:

Version	Key Features	Notable Attacks
LockBit 1.0 (2019)	.abcd extension, basic encryption	Early healthcare targets
LockBit 2.0 (2021)	StealBit module, automated propagation	Royal Mail disruption
LockBit 3.0 (2022)	Triple extortion tactics, random extensions	Wabtec $30M demand
LockBit Green (2023)	Cross-platform support (ESXi, Linux)	VMware ESXi clusters

Security Implications and Mitigation

The leaked data provides defenders with actionable intelligence. Network defenders should monitor for:

“Known LockBit C2 IP ranges (185.xx.xx.xx/24, 45.xx.xx.xx/22) and TLS certificate fingerprints matching their infrastructure. The leak confirms their continued exploitation of PaperCut (CVE-2023-27350) and GoAnywhere (CVE-2023-0669) vulnerabilities.”⁵

Recommended defensive measures include:

Implementing strict egress filtering for uncommon ports (8085, 4433)
Monitoring for process injection patterns matching LockBit’s known techniques
Applying patches for vulnerabilities listed in CISA Advisory AA23-165A⁶

Future Outlook

While Operation Cronos disrupted LockBit in February 2024, seizing 34 servers across 8 countries⁷, the group demonstrated rapid recovery capabilities. This new breach may cause longer-term damage by exposing affiliate identities and operational security failures. The leaked data reveals internal concerns about law enforcement infiltration and potential exit scams by core members.

Security teams should anticipate possible rebranding or fragmentation of the LockBit operation, with affiliates potentially migrating to other RaaS platforms like BlackCat or Cl0p. The cross-platform capabilities demonstrated in LockBit Green suggest future variants may target cloud workloads and containerized environments more aggressively.