LockBit Operator: Russia Is the Best Country for Cybercriminals

The operator of the LockBit ransomware, in an interview with Cisco Talos researchers, shared insights into cybercriminal operations, the tools used, his methods and preferred targets, and reflected on why he chose to “cross over to the dark side.”

Malware like LockBit has caused significant problems for corporations in recent years. Ransomware operators now not only encrypt important files but also steal confidential information, threatening to publish it if their demands aren’t met.

In an interview (PDF) with the Cisco Talos team, a LockBit operator introduced as Alex discussed the challenges of his trade and the nuances of life as a cybercriminal.

Background of the LockBit Operator

It is believed that Alex lives in Siberia and is entirely self-taught. He learned everything on his own, including cyber intelligence, penetration testing, network security, and related skills.

Alex is reportedly in his early thirties. He initially tried to work for a regular IT company but “quickly became disillusioned when he wasn’t accepted by the Russian-speaking IT community.” According to Cisco Talos, Alex’s enthusiasm and suggestions were simply ignored by company management.

Turning to Cybercrime

One might think that if you’re not valued as a cybersecurity expert in Russian companies, you could always move into vulnerability research. Many tech giants offer good money for information about security flaws in their products.

However, the LockBit operator quickly abandoned this idea. According to him, these corporations do everything they can to avoid fairly compensating researchers who report bugs in their code.

Still, Alex’s interest in cybercrime seems to go beyond just financial gain. In the interview, he mentioned that he wanted to “teach companies a lesson and show them the consequences of not properly protecting their data.”

Why Russia Is the Best Country for Cybercriminals

Perhaps most interestingly, Alex named Russia as the most suitable country for cybercriminals. The reason? Organizations in Europe and the United States pay ransoms much faster than those elsewhere.