LockBit is Back in Business – 50+ Victims Reported in Just 60 Days

The notorious LockBit ransomware gang is making headlines once again, proving that their reign in the cybercrime world is far from over. Following the recent shutdown of RansomHub, LockBit operators seem to have quickly regained momentum, unleashing a surge of new attacks across the globe.

Also read: LockBit Ransomware Decryptor

Over the past 60 days, our team has received reports from more than 50 victims worldwide, many of whom have confirmed infections linked to LockBit 3.0 Black Edition. This sudden spike suggests that LockBit is aggressively reclaiming lost ground and potentially targeting organizations that were previously in the sights of RansomHub.

Ransom Notes with Multiple Contact Options

Victims report that the latest LockBit 3.0 Black Edition ransom notes include:

• ProtonMail addresses for communication.
• TOX IDs for encrypted chat.
• In some cases, a unique session ID that victims must use to establish contact with the attackers.

This approach indicates LockBit is refining its extortion methods, ensuring victims have multiple secure channels to negotiate, while making it harder for law enforcement to track or intercept communications.

Why the Surge?

Cybersecurity experts believe that after the collapse of RansomHub operations, many affiliates and cybercriminals may have migrated back to LockBit, boosting its activity. LockBit’s reputation for stability, advanced encryption, and profitable extortion models makes it an attractive option for affiliates seeking a reliable ransomware-as-a-service (RaaS) partner.

A Warning to Businesses

This resurgence serves as a stark reminder for businesses to tighten their defenses. LockBit’s Black Edition is known for:

• Rapid network-wide encryption.
• Double extortion tactics (encrypting files and threatening to leak data).
• Use of multiple negotiation channels to pressure victims into paying.

Companies are urged to review their security posture, update incident response plans, and invest in ransomware-specific defenses.

Conclusion

With LockBit powering up once again after RansomHub’s exit, organizations worldwide face a renewed wave of ransomware threats. The cybercrime landscape remains volatile, and LockBit’s return signals yet another dangerous chapter in the ongoing ransomware epidemic.