LockBit

LockBit Takedown: Operation Cronos and Its Awkward Aftermath

Post author:Prabhu Kalyan Samal
Post published:February 23, 2024
Post category:Emerging Tech & Architecture Ransomware & Malware Security

February 2024's Operation Cronos seized LockBit's infrastructure across a dozen countries — and then the leaks showed how long the FBI had been inside. This account covers the covert access, the sting timing driven by UK hospital targeting, the servers and affiliate accounts taken down, the hurried rebrand to LockBit 4.1, the affiliate diaspora to RansomHub and Akira, and the awkward questions the takedown's trolling raised about reading crime statistics.

LockBit, CitrixBleed, and the ICBC Treasury Hack

Post author:Prabhu Kalyan Samal
Post published:November 11, 2023
Post category:Ransomware & Malware Security Web & API Security

When LockBit hit ICBC's US broker-dealer on 9 November 2023, Treasury-market connectivity went dark and manual settlement took over for days. The entry path traced to CitrixBleed session tokens stolen before the October patch and never invalidated — exactly what CISA's Emergency Directive 23-08 had warned. LockBit claimed a roughly $9 million ransom demand, never verified. The post walks the token-replay kill chain, the disclosure-era aftermath, and the defensive lesson that remediation includes revocation.

CitrixBleed CVE-2023-4966: Session Tokens Straight From Memory

Post author:Prabhu Kalyan Samal
Post published:October 10, 2023
Post category:Cloud & Infrastructure Security Web & API Security

CVE-2023-4966 let attackers read valid session tokens out of NetScaler memory and inherit authenticated sessions wholesale — MFA already passed. CISA's Emergency Directive 23-08 forced hunts and rebuilds as LockBit monetized the access.

Royal Mail vs LockBit: The $80M Ransom Refusal

Post author:Prabhu Kalyan Samal
Post published:January 18, 2023
Post category:Emerging Tech & Architecture Ransomware & Malware Security

LockBit encrypted Royal Mail's international sorting operations in January 2023 and demanded $80M. Royal Mail paid nothing and kept the letters moving.

LockBit 3.0’s Bug Bounty: When Ransomware Ran Its Own QA

Post author:Prabhu Kalyan Samal
Post published:July 18, 2022
Post category:Ransomware & Malware Security

A criminal franchise paid up to $1M for flaws in its own malware, website, and Tor infrastructure — Silicon Valley tactics inside the ransomware economy.