LockBit ransomware has certainly not gone away as a threat; the data breach shows that the group communicated with victims over 4,000 times just between December 2024 and April 2025, and that it still has around 75 affiliates.
The LockBit ransomware group has set up a new data leak site and also posted a long and defiant rant indicating that it intends to keep operating and that its leader, who goes by “LockBitSupp,” is not working with law enforcement as was previously reported.
An international law enforcement action called “Operation Chronos” has seized servers, dark web assets, crypto wallets and decryption keys, leaving the LockBit ransomware group limited in its capacity to do harm.
Data breach involving the Lockbit ransomware gang and a major provider of US government-subsidized medical care has resolved in about the worst way possible, with the sensitive personal information of nearly nine million patients dumped to the public.
A breach of a third party vendor appears to have provided the LockBit ransomware gang with 3,000 sensitive SpaceX engineering schematics, which the criminals are threatening to take to auction if the company does not pay up.
The LockBit ransomware gang insisted on a ransom demand that was calculated based on the entirety of Royal Mail’s annual revenue, rather than the specific international branch it hit, and would not back down.
Mandiant has announced an internal investigation revealing no sign of LockBit ransomware, but the group’s goal may have been to publicly create space between it and Evil Corp.