How LockBit Ransomware Priced Pressure Into Its Product
Why LockBit Ransomware Added a Third Lever
Encryption alone stopped closing deals somewhere around 2020. Enough companies had offline copies, tested restores and cyber insurance policies that demanded both, so a locked file server became an expensive weekend rather than an existential threat. Double extortion answered that by stealing the files first and threatening publication, which works on regulated industries because the notification bill and the class action arrive whether or not the servers come back. The next escalation was availability. Triple extortion ransomware keeps the encryption and the publication threat, then adds sustained flooding of whatever the victim shows the public: the checkout page, the patient portal, the API that partners depend on. The pitch to a negotiator is that refusing costs money every hour, visibly, in front of customers. LockBitSupp, the persona speaking for the operation on Russian-language forums, advertised the shift in blunt terms, saying the team was recruiting people who could run floods and would from then on combine encryption, leaks and network disruption. That post read as a job advert as much as a warning. What made DDoS extortion appealing was cost. Hiring a booter service is trivially cheap next to developing an exploit chain, and the skill pool already existed on the same boards where affiliates were recruited. Adding a third lever required no new engineering, only a different subcontractor.
Ten Days of Floods Against a Data Leak Site
Entrust, a Minnesota company selling certificates and identity hardware, was compromised on 18 June 2022. It confirmed an intrusion, told customers the incident touched internal systems, and refused to pay. LockBit set 19 August as the publication date and posted a countdown. The countdown expired and nothing appeared. The gang's data leak site had been buried under HTTPS requests, reportedly from several hundred servers pushing roughly a thousand requests per second, with the victim's name and a message telling the operators to delete the files stuffed into the request strings. Whoever paid for it wanted attribution. Security researchers assumed the target had commissioned the flood, or that a party acting on its behalf had. Nobody proved it, and Entrust never commented. Commissioning an attack against criminal infrastructure is itself unlawful in most jurisdictions, which is why organisations that consider it tend not to leave a paper trail. The delay bought days, not silence. By late August the operation published a 343 gigabyte archive as a torrent and seeded it through several file hosts, having first handed copies privately to anyone who asked. That sequencing is the real lesson: once data is distributed to third parties, taking down the original publisher accomplishes very little, and the victim has spent legal risk on a postponement.
The Affiliate Economics Behind LockBit 3.0
The version that appeared at the end of June 2022 shipped with a rebuilt commercial structure. Under the earlier model, ransom payments landed in wallets the core team controlled, and affiliates waited to be paid their share. LockBit 3.0 inverted that: the intruder collected the victim's payment directly and remitted a percentage upward, typically around a fifth. For an experienced affiliate that reordering matters more than any technical feature. It removes the risk that the developers simply keep the money, a betrayal that had wrecked reputations across several competing crews. The operation was selling trust, which is the scarcest commodity in a market where every participant is a criminal and nobody can sue. Other changes followed the same logic. Payments were accepted in Zcash alongside Bitcoin and Monero. The panel let affiliates set their own demands, edit the note text, choose which files to publish first, and buy extra time on the countdown. Ransomware as a service had become genuinely self-service. This is what a mature ransomware affiliate program looks like from the inside, and it explains the volume. Recruiting is easier when a candidate can model their expected income, and retention improves when leaving means rebuilding tooling, negotiation support and a publication channel from scratch somewhere else.
A Bug Bounty Run by Extortionists
The launch announcement carried something no ransomware crew had tried before: a bug bounty, paying from a thousand dollars up to a million. The scope listed website vulnerabilities, flaws in the encryption routine, weaknesses in the messaging system, and problems in the onion infrastructure that hosted negotiations. Two entries stood out. One offered payment for what the post called brilliant ideas, meaning suggestions to improve the operation. The other offered a million dollars to anyone who could identify the human being behind LockBitSupp, framed as a challenge and clearly intended to project confidence in their own operational security. Read as marketing, the bounty was effective. It generated coverage on every security news outlet, signalled to affiliates that the platform would not collapse from a trivial web bug, and mocked the legitimate disclosure programmes it copied. Read as engineering, it admitted a real problem: researchers had repeatedly found sloppy mistakes in ransomware builders and negotiation portals, and decryptors have been published off the back of exactly that kind of error. The bounty also documents how much of this business is reputation management. A crew that looks amateurish loses recruits to rivals, and a crew that looks untouchable extracts higher payments because victims believe the threats will be carried out.
The Builder Leak That Cloned LockBit Black Ransomware
In September 2022 the encryptor builder went public. A user posting as ali_qushji claimed to have found it on a poorly secured server, and an earlier leaker using another handle said a disgruntled developer had passed it along. Either way the archive circulated freely, containing the key generator, the builder executable, a configuration file and a batch script. Anyone who downloaded it could produce a working lockbit black ransomware payload with their own note text, their own contact details and their own key pair, owing nothing to the original team. Within weeks researchers were tracking unrelated crews doing exactly that, including the Bl00dy gang, which pointed the borrowed encryptor at victims of its own. That created a genuine problem for the brand. Attribution turned into guesswork, since a note bearing the familiar name might come from the core operation, a licensed affiliate, or a teenager with a leaked builder and no ability to decrypt anything afterwards. Victims negotiating with an unknown party have no basis for assuming a working key exists. For defenders the leak was mixed news. Analysts gained a complete specimen to study, which sharpened detection rules and yielded clean documentation of the file-marking and configuration format. It also multiplied the number of groups capable of deploying a fast, well-written encryptor.
Why the Flooding Tactic Underdelivered
Adding availability pressure sounded strong on a forum post and disappointed in practice. Large organisations already sit behind scrubbing providers, and a public site that survives ordinary botnet traffic will usually survive a rented flood. Rate limiting, anycast distribution and challenge pages are commodity features now, bundled with hosting rather than bought as projects. There is a timing problem too. When an intruder has just encrypted the internal estate, the victim's public services are frequently already offline, so flooding them adds nothing to a negotiation already at maximum urgency. The pressure only bites against a company that recovered quickly, and a company that recovered quickly is generally the one with mitigation in place. The tactic is also symmetrical, which the Entrust episode demonstrated. Extortion infrastructure needs to stay reachable to be useful, and onion services are considerably harder to protect than clearnet ones. The response was more mirrors, per-victim randomised addresses in notes, and copies pushed to ordinary file hosts. For incident responders the sensible planning assumption is that any of the three levers may appear in any order. Keep a scrubbing contract signed before you need it, know the phone number of the engineer who can enable it at three in the morning, and rehearse serving a static holding page from somewhere unconnected to the network under attack.
Reading a Victim Listing With Proper Suspicion
Leak site entries are advertisements, and they should be read that way. The lockbit ransomware group listed well over a thousand named organisations across its lifetime, and researchers who checked found the roster padded in predictable directions. Some entries recycled data from older incidents under a new date. Some named a household brand when the compromise had actually hit a small supplier handling one contract. Some victims never confirmed any intrusion at all. The incentives are obvious. A long roster reassures affiliates the platform delivers results, frightens the next negotiator into settling early, and gives journalists something to write about for free. Nobody involved is penalised for exaggeration. So a listing is a claim requiring corroboration: a filing to a regulator, a notification letter to affected people, a statement from the company, or independent analysis of the published archive. Publishing a victim count that came straight off an extortion portal repeats a criminal's press release with a masthead on it. For defenders the practical value of monitoring these sites is narrower than vendors suggest. It gives early warning when a named supplier appears, which is worth having. It does not measure the threat, and it should never anchor a decision about where the security budget goes next quarter.
Frequently asked questions
What made LockBit different from other ransomware crews?
Mostly commercial design rather than code. It paid affiliates by letting them collect ransoms directly and remit a share upward, ran a bug bounty against its own software, published version notes, and kept a talkative public persona on criminal forums. That combination attracted skilled intruders and produced one of the largest victim rosters ever assembled.
Did the DDoS against the leak site protect Entrust?
It delayed publication past the announced deadline and no further. The archive appeared as a 343 gigabyte torrent shortly afterwards, seeded through several file hosts, after copies had already gone privately to anyone who asked. Commissioning such an attack is also unlawful in most jurisdictions, which makes it a poor incident response option.
Does paying stop stolen files from being published?
There is no way to verify deletion. Negotiators report cases where payment produced a working decryptor and a promise, then the same data surfaced later through an affiliate or a broker. Assume anything exfiltrated is permanently outside your control and spend the effort on notification, credential resets and monitoring instead.
How did the leaked builder change the risk?
It let unrelated groups generate their own payloads carrying the familiar branding, so a ransom note no longer identifies who you are dealing with. That matters during negotiation, because an opportunist working from a leaked builder may hold no usable key at all. Detection improved at the same time, since analysts finally had complete samples.
What defences actually matter against this model?
Immutable or air-gapped backups with restores tested on a schedule, phishing-resistant multi-factor authentication on remote access, segmentation that stops a domain admin credential reaching everything, and monitoring for bulk outbound transfers. Add a pre-signed traffic scrubbing arrangement so availability pressure becomes a phone call rather than a procurement exercise.