lockbit2 attacks National Intellectual Property Office
Incident Date:
May 6, 2022
Overview
Title
lockbit2 attacks National Intellectual Property Office
Victim
National Intellectual Property Office
Attacker
Lockbit2
Location
First Reported
May 6, 2022
LockBit2 Ransomware Attack on National Intellectual Property Office of Sri Lanka
The National Intellectual Property Office of Sri Lanka (NIPO) has recently fallen victim to a ransomware attack orchestrated by the LockBit2 group, as disclosed on their dark web leak site. The NIPO, a pivotal entity within the Government sector, plays a crucial role in the administration of intellectual property rights across Sri Lanka. Despite the significance of its operations, specific details regarding the organization's size and potential vulnerabilities remain undisclosed.
The LockBit2 ransomware, emerging in the cyber landscape around January 2020, has been implicated in upwards of 1,400 global attacks, cumulatively demanding over $100 million in ransoms and successfully extorting upwards of $75 million. This group's modus operandi aligns with that of other notorious ransomware entities like Babuk and Hive, involving the identification and exploitation of vulnerable digital infrastructures, deployment of ransomware, and subsequent ransom negotiations with the affected parties.
With a track record of targeting over 1,400 victims, including numerous entities within the United States and globally, the LockBit ransomware group has established itself as a formidable threat. Their strategy encompasses data encryption and exfiltration, coupled with threats of public disclosure unless a ransom is paid, culminating in negotiations over the ransom amount with their victims.
While the NIPO's official website, http://www.nipo.gov.lk/, offers insights into their services and operational framework, it stops short of shedding light on the organization's distinctive attributes or the specific vulnerabilities that rendered it susceptible to the LockBit2 ransomware attack.
This incident serves as a stark reminder of the persistent cyber threats facing organizations worldwide, accentuating the critical need for robust cybersecurity defenses and heightened vigilance in identifying and mitigating potential threats.
Sources
- National Intellectual Property Office of Sri Lanka. (n.d.). Welcome to the National Intellectual Property Office of Sri Lanka. Retrieved April 10, 2024, from http://www.nipo.gov.lk/
- U.S. Department of Justice. (2023, May 17). Russian National Charged with Ransomware Attacks Against Critical Infrastructure. Retrieved April 10, 2024, from https://www.justice.gov/opa/pr/russian-national-charged-ransomware-attacks-against-critical-infrastructure
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.