Lockbit

how they have basically built an internal search so that people can find and slice their data for all of the victim data, right? That's something very unique.

And then you've got LockBit 3.0. Another researcher was talking to us about LockBit, LockBit 3.0, and how they've developed this LockBit Black, which really

eliminates the need for IABs.

They won't even need initial access brokers.

What's your advice to someone who's interested in becoming you?

Well, the first piece of advice I wanna give, LockBit took down a children's, uh, cancer hospital.

A- and that, y- those feelings, the ...

I wrote, "I am hate, I am rage, I am vengeance."

Yep.

Uh, went out, went out to the dark web, started looking at bad guys and profiling 'em, and I realized a lot of these guys were, were accessible and would talk.

So I started creating s- fake personas, uh, spending time with them, trying to join ransomware gangs, uh, and I got in with a group called LockBit.

Now, after about six months, I published a report, foolishly put my name on it [laughs] and, uh, the next day they had a new avatar, uh, on their account on the dark web with my face on it.

They're going for data exfiltration, uh, because the target in which they have been assigned has a purpose and value in the data they're going after.

However, then there's sort of the maybe kind of complicate, obfuscate where we've seen, like LockBit, for example, Ransomhub, I think even Sodinokibi.

This is a while back.

There are threat actor groups out there whose ransomware as a service ecosystem has f- got their affiliates and will, for the most part, target people for money, return on investment, ROI.

Where we're seeing a risk of either re-extortion or threat actors not being good in their promise are those that are in the unknown game.

So after Black Hat went offline and LockBit, got sanctioned and they shut down, you saw a lot of affiliates say, I'm not going to hook up with another affiliate.

I'm going to go and try it on my own.

As you know, there's so much leaked code and malware out there.

LockBit's got multiple versions out there, as well as Black Hat and other variants toolkits that are leaked, are using to say, I'm just going to go and attack myself.

They're not part of a playbook.

So typically when we see that, we usually throw flags on that to state that there's a much higher risk because this is not a well known affiliate.

PaperCut has been here before.

Its servers were hammered in twenty twenty-three through an authentication bypass flaw, attacks eventually linked to Clop, LockBit, Iranian state backed groups, and the bloody ransomware gang.

PaperCut has now put CVE numbers and technical details on the table.

CVE-2026-81578 is a high severity authentication bypass in the web management interface, rated eight point eight out of ten.

DFIR, if you don't know, is their digital forensics and incident response team, just in case some of our listeners weren't tracking that acronym.

And CLOP and LockBit, for those that don't know, are some of the top ransomware as a service actors.

They don't just do ransomware, but data theft, right? Take it and then hold it hostage until they pay.

And they attack global organizations.

Yeah,

LockBit could never.

LockBit could not stand to the numbers that these guys are achieving.

comes close because the way they do there, they do mass compromise.

Yeah, they do, yeah.