The National Crime Agency (NCA) and its partner agencies have released some limited information about LockBit’s public face, LockBitSupp, through the gang’s dark web leak site. The agencies gained control of the site in a successful operation called Operation Cronos. In an update posted on Friday, the NCA refuted previous claims made by LockBitSupp about his location and car, revealing that he drives a Mercedes. They also stated that they know his identity, where he lives, and his net worth. The update, which used a tone reminiscent of internet trolls, is designed to unnerve LockBit crew members and affiliates who are still on the loose. The update also hinted at the possibility that LockBitSupp is located in Russia, as he may struggle to find spare parts for a Mercedes. The suggestion that LockBitSupp had engaged with law enforcement indicates that he may have cooperated with the takedown. It is already known that LockBitSupp was banned from several cybercriminal forums in 2024, and the gang had been struggling to regain its former position. Analyst1’s chief security strategist, Jon DiMaggio, has conducted extensive research on LockBitSupp and believes he may be two people – the leader and another core member of the gang. The NCA has also provided more information on its analysis of LockBit’s payment infrastructure, revealing that they have seized 30,000 bitcoin addresses and identified 500 active ones receiving around £100m. Further analysis revealed 2,200 unspent bitcoins, equating to over £90m. The NCA noted that this only represents a portion of LockBit’s activities, and the actual ransom totals are likely to be much higher, potentially reaching multibillion-dollar sums given the number of confirmed LockBit attacks.
Menu
