LockBit Ransomware Group Threatens Federal Reserve Board with Data Leak

Update July 15, 2024: After the claims of the hack, the Tor leak site of the Lockbit group went down. It’s now back up at (http://lockbit7z2jwcskxpbokpemdxmltipntwlkmidcll2qirbu7ykg46eyd.onion) but there is no leak. Either the ransom was paid, or the hack was never legitimate.

As of June 25, 2024, the notorious LockBit ransomware group has allegedly breached the Fed’s systems and is threatening to release 33 terabytes of sensitive government data if their ransom demands are not met.

The Threat and Its Implications

LockBit, a ransomware group with suspected ties to Russia, posted on their dark website: “33 terabytes of juicy banking information containing Americans’ banking secrets. You better hire another negotiator within 48 hours, and fire this clinical idiot who values Americans’ bank secrecy at $50,000.”

This threat, if genuine, could have severe implications for national security and the financial sector. The Federal Reserve Board, being a crucial component of the U.S. financial system, holds vast amounts of sensitive data. A breach of this magnitude could potentially expose confidential information about American banking operations and individual financial records.

LockBit’s Track Record

LockBit has a history of high-profile attacks across various sectors, including:

• Small businesses
• Multinational corporations
• Hospitals
• Schools
• Nonprofit organizations
• Critical infrastructure
• Government and law-enforcement agencies

Notable targets have included the Thales Group, the Toronto Hospital for Sick Children, and the U.S. subsidiary of the Industrial and Commercial Bank of China.

Escalating Cybersecurity Tensions

This alleged attack comes amid rising cybersecurity tensions between the United States and Russia. Recent actions by the U.S. government include:

1. Banning the use of Kaspersky anti-virus software
2. Placing 12 Kaspersky executives on the Specially Designated National List
3. Indicting Dimitry Yuryevich Khoroshev, alleged mastermind behind LockBit, by the Treasury Department on May 7

Morgan Wright, chief security advisor to SentinelOne and SC Media columnist, noted that Russian cyberattacks often serve as retaliation for perceived or actual actions by other nations. He cited the BlackEnergy attack on Ukraine in 2015 as an example of such retaliatory measures.

Ongoing Investigation and Response

As of the latest update, the Federal Reserve Board has not confirmed the breach. When contacted, the FBI declined to comment on the situation, stating, “The FBI declines to comment.

Agnidipta Sarkar, vice president, and CISO Advisory at ColorTokens, emphasized the need for further updates and potential regulatory intervention. He stated, “If this is indeed true, regulators will need to intervene to ensure that (potentially impacted) businesses are breach-ready, and banks will need to prioritize foundational cybersecurity by isolating critical operations from other systems.”

Despite recent law enforcement actions against LockBit, including infrastructure seizures and the exposure of its alleged leader, the group appears to have continued its criminal activities. This persistence underscores the ongoing challenges in combating sophisticated ransomware operations.