What exactly is LockBit ransomware and how does it work?

The LockBit ransomware operation has once again dominated headlines, as we learned that they were responsible for the UK’s Royal Mail attack.

Royal Letter is the United Kingdom’s leading mail delivery service, and its interruption substantially influences the country’s economy and supply chain.

Royal Mail in London, England, was the victim of a cyberattack on Wednesday, which resulted in the suspension of international shipping services.

We learned yesterday that this outage was triggered by a LockBit ransomware assault, which locked the machines used to generate customs dockets for overseas commerce.

LockBit has gotten highly unruly as it has become the most extensive ransomware operation, with affiliates targeting critical infrastructure and children’s hospitals, despite the gang’s restrictions.

LockBit eventually provided a free decryptor to SickKids Children’s Hospital, but it is still being determined if they would do the same for Royal Mail.

This week, we also learned that the Vice Society Ransomware operation hacked and exposed data for Fire Rescue Victoria, Australia’s largest fire and rescue organization.

New ransomware research has also been released or uncovered, as shown by the following reports:

• Rapid 7’s technical report on the Hive Ransomware.
• The Cuba Ransomware attack uses the Microsoft Exchange OWASSRF weakness.
• Finally, the Lorenz ransomware organization is placing backdoors months later for first access.

Due to the active exploitation of the OWASSRF issue by the Cuba and Play ransomware operations, CISA now mandates government agencies to fix the flaw by the end of January