“I didn’t pay much attention to it, because for 5 years of swimming in money I became very lazy,” LockBitSupp said. “At 20:47 I found that the site gives a new error 404 Not Found nginx, tried to enter the server through SSH and could not, the password did not fit, as it turned out later all the information on the disks was erased.”
The note further explained that the hacked servers ran PHP version 8.1.2, which is affected by a remote code execution (RCE) enabling flaw CVE-2023-3824, which possibly allowed the authorities to gain access to LockBit’s systems.
“The version installed on my servers was already known to have a known vulnerability, so this is most likely how the victims’ admin and chat panel servers and the blog server were accessed,” LockBitSupp added, pointing out that new LockBit servers are now running the latest version of PHP 8.3.3.
All other servers that did not have PHP installed are unaffected and will continue to give out data stolen from the attacked companies, the note added.
LockBit to make some infrastructure adjustments
In the seizure, international law enforcement took over many of LockBit’s leak sites, 34 of its servers spanning those in the United States, the United Kingdom, the Netherlands, Germany, Finland, France, Switzerland, and Australia, 200 cryptocurrency accounts, and 14,400 rogue email accounts.
Additionally, the authorities had collected about 1000 decryption keys, which the note claims were obtained from “unprotected decryptors,” and represent merely 2.5% of the total number of decryptors LockBit issued within five years of its operations. Though bad, it is not fatal to its operations, LockBitSupp added.
