{
	"id": "ef01c70d-637a-4a38-a172-dbdc8c14d2c3",
	"created_at": "2026-04-06T03:37:58.382214Z",
	"updated_at": "2026-04-10T03:20:04.588177Z",
	"deleted_at": null,
	"sha1_hash": "81f1ed257e68b307150f7f5fc3620acf9ba17500",
	"title": "LockBit's seized darknet site resurrected by police, teasing new revelations",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 84313,
	"plain_text": "LockBit's seized darknet site resurrected by police, teasing new\r\nrevelations\r\nBy Alexander Martin\r\nPublished: 2024-05-05 · Archived: 2026-04-06 03:16:06 UTC\r\nThe ransomware service LockBit’s darknet extortion site, which had been shuttered earlier this year after being\r\ninfiltrated by law enforcement, reappeared on Sunday with police teasing fresh information about the criminals\r\ninvolved.\r\nIt follows the closure of the site in February, after the United Kingdom’s National Crime Agency (NCA)\r\nannounced they had hacked the ransomware-as-a-service platform and “gained unprecedented and comprehensive\r\naccess to LockBit’s systems.”\r\nWhile the site had previously been used to publish stolen information from the ransomware gang’s victims, under\r\nthe control of the NCA it was instead used to show off how much information investigators had obtained from the\r\nservice’s backend.\r\nThis information was published under the proviso that what the police were releasing didn’t interfere with ongoing\r\ninvestigations. A week of revelations subsequently appeared on the site, each of them trailered beneath a\r\ncountdown, including claims that LockBit did not delete data even when it had pledged to victims to do so.\r\nThe fruits of some of those investigations are likely to be published on the site soon, with the resurrected darknet\r\npage teasing a range of information alongside timers set to 14:00 UTC on Tuesday, May 7.\r\nFollowing the disruption operation in February, in an interview with the Click Here podcast, the group’s purported\r\nleader LockbitSupp claimed investigators had overstated the depth of their access into the gang’s backend\r\ninfrastructure.\r\nDuring the initial week of revelations, the final big reveal — a tile titled “Who is LockbitSupp?” — suggested that\r\nlaw enforcement would finally de-anonymise the site’s administrator.\r\nBut when the post was published, it did not provide a name. Instead, it stated that LockbitSupp had lied about\r\nliving in the United States and the Netherlands, and suggested he actually lived in Russia. This location, which\r\nmany had otherwise assumed, appeared alongside the assertion that he drove a Mercedes and the oblique claim\r\nthat he had “engaged with law enforcement.”\r\nThat the post did not reveal a name was, as The Register put it, “a bigger letdown than Game of Thrones Season\r\n8.” “Who is LockbitSupp? The $10 million question,” repeats the current version of the splash page, suggesting\r\nthat Tuesday’s announcement won’t prove similarly anticlimactic. \r\nhttps://therecord.media/lockbit-ransomware-gang-seized-site-reappears-teasing-new-information\r\nPage 1 of 2\n\nAlexander Martin\r\nis the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow\r\nat the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal\r\non: AlexanderMartin.79\r\nSource: https://therecord.media/lockbit-ransomware-gang-seized-site-reappears-teasing-new-information\r\nhttps://therecord.media/lockbit-ransomware-gang-seized-site-reappears-teasing-new-information\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://therecord.media/lockbit-ransomware-gang-seized-site-reappears-teasing-new-information"
	],
	"report_names": [
		"lockbit-ransomware-gang-seized-site-reappears-teasing-new-information"
	],
	"threat_actors": [],
	"ts_created_at": 1775446678,
	"ts_updated_at": 1775791204,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/81f1ed257e68b307150f7f5fc3620acf9ba17500.pdf",
		"text": "https://archive.orkl.eu/81f1ed257e68b307150f7f5fc3620acf9ba17500.txt",
		"img": "https://archive.orkl.eu/81f1ed257e68b307150f7f5fc3620acf9ba17500.jpg"
	}
}