{
	"id": "1f875473-2427-4ec1-ae43-ab1363b4e14e",
	"created_at": "2026-04-06T00:10:47.979618Z",
	"updated_at": "2026-04-10T03:26:47.129294Z",
	"deleted_at": null,
	"sha1_hash": "e1d3752cf93acbc45691227d095933a0d7869b4c",
	"title": "LockBit administrator ‘has engaged with law enforcement,’ police claim",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 34073,
	"plain_text": "LockBit administrator ‘has engaged with law enforcement,\r\n’ police\r\nclaim\r\nBy Alexander Martin\r\nPublished: 2024-02-23 · Archived: 2026-04-05 18:01:00 UTC\r\nLockbitSupp, or the individual behind that account representing the ransomware service on cybercrime forums,\r\n“has engaged with law enforcement,” police claimed on Friday.\r\nAn operation led by Britain’s National Crime Agency (NCA) alongside the FBI, Europol, and other international\r\npartners, seized LockBit’s darknet website on Monday.\r\nDuring a press conference in London on Tuesday morning, the NCA’s director general, Graeme Biggar,\r\nannounced his agency had “gained unprecedented and comprehensive access to LockBit’s systems.”\r\nThroughout this week, police have used the seized website to reveal details about the LockBit gang in the same\r\nstyle in which the criminals had previously published details about their extortion attempts, with a countdown\r\ntimer intended to encourage victims to pay up.\r\nIn a post published Friday titled “Who is LockbitSupp?,” law enforcement said the account holder had lied about\r\nliving in the United States or the Netherlands, as well as owning a Lamborghini.\r\n“He drives a Mercedes (though parts may be hard to source),” stated the site, potentially referencing the impact on\r\nthe automotive industry of sanctions imposed against the Russian Federation following the invasion of Ukraine.\r\nThe post did not contain substantial information about the individual’s identity, but claimed that law enforcement\r\nknew who was behind the account.\r\n“We know who he is. We know where he lives. We know how much he is worth,” states the message on the seized\r\nsite, alongside the announcement: “LockbitSupp has engaged with Law Enforcement :).”\r\nIt is not clear whom the message is targeting. It is not an indictment against a specific individual — a legal\r\nallegation that must be supported by evidence — nor does it name an individual for the purposes of imposing\r\nfinancial and travel sanctions.\r\nGet more insights with the\r\nRecorded Future\r\nIntelligence Cloud.\r\nLearn more.\r\nhttps://therecord.media/lockbit-administrator-engaging-with-police\r\nPage 1 of 2\n\nSource: https://therecord.media/lockbit-administrator-engaging-with-police\r\nhttps://therecord.media/lockbit-administrator-engaging-with-police\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://therecord.media/lockbit-administrator-engaging-with-police"
	],
	"report_names": [
		"lockbit-administrator-engaging-with-police"
	],
	"threat_actors": [
		{
			"id": "0fc739cf-0b82-48bf-9f7d-398a200b59b5",
			"created_at": "2022-10-25T16:07:23.797925Z",
			"updated_at": "2026-04-10T02:00:04.752608Z",
			"deleted_at": null,
			"main_name": "LockBit Gang",
			"aliases": [
				"Bitwise Spider",
				"Operation Cronos"
			],
			"source_name": "ETDA:LockBit Gang",
			"tools": [
				"3AM",
				"ABCD Ransomware",
				"CrackMapExec",
				"EmPyre",
				"EmpireProject",
				"LockBit",
				"LockBit Black",
				"Mimikatz",
				"PowerShell Empire",
				"PsExec",
				"Syrphid"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434247,
	"ts_updated_at": 1775791607,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/e1d3752cf93acbc45691227d095933a0d7869b4c.pdf",
		"text": "https://archive.orkl.eu/e1d3752cf93acbc45691227d095933a0d7869b4c.txt",
		"img": "https://archive.orkl.eu/e1d3752cf93acbc45691227d095933a0d7869b4c.jpg"
	}
}