LockBit administrator ‘has engaged with law enforcement,’ police claim

LockbitSupp, or the individual behind that account representing the ransomware service on cybercrime forums, “has engaged with law enforcement,” police claimed on Friday.

An operation led by Britain’s National Crime Agency (NCA) alongside the FBI, Europol, and other international partners, seized LockBit’s darknet website on Monday.

During a press conference in London on Tuesday morning, the NCA’s director general, Graeme Biggar, announced his agency had “gained unprecedented and comprehensive access to LockBit’s systems.”

Throughout this week, police have used the seized website to reveal details about the LockBit gang in the same style in which the criminals had previously published details about their extortion attempts, with a countdown timer intended to encourage victims to pay up.

In a post published Friday titled “Who is LockbitSupp?,” law enforcement said the account holder had lied about living in the United States or the Netherlands, as well as owning a Lamborghini.

“He drives a Mercedes (though parts may be hard to source),” stated the site, potentially referencing the impact on the automotive industry of sanctions imposed against the Russian Federation following the invasion of Ukraine.

The post did not contain substantial information about the individual’s identity, but claimed that law enforcement knew who was behind the account.

“We know who he is. We know where he lives. We know how much he is worth,” states the message on the seized site, alongside the announcement: “LockbitSupp has engaged with Law Enforcement :).”

It is not clear whom the message is targeting. It is not an indictment against a specific individual — a legal allegation that must be supported by evidence — nor does it name an individual for the purposes of imposing financial and travel sanctions.