The LockBit ransomware gang claimed to have breached the network of Mandiant and stolen data. The US-based cybersecurity firm has investigated these claims.
See also: Ransomware gangs claim the same victims
The ransomware group posted a new page on its data leak website, saying that the 356,841 files that supposedly came from Mandiant will be leaked online.
The gang's leak site even posted a timer showing the end of the countdown, with the message "All available data will be published!"
After LockBit published the files, it became apparent that they were not files stolen from Mandiant's network, but instead, the ransomware group is trying to distance itself from the cybercrime gang EvilCorp.
This was likely caused because LockBit feared lost revenue because their victims would stop paying ransoms as Evil Corp is sanctioned by the US.
See also: Ransomware gang displays “ransom notes” on the homepage of victims' sites
“Mandiant is aware of these allegations related to LockBit. At this point, we have no evidence to support their claims. We will continue to monitor the situation as it develops,” said Mark Karayan, Senior Director of Marketing Communications at Mandiant, before the files were posted on LockBit’s website.
These allegations came after Mandiant revealed in a report published last week that the Russian-has now turned to deploying LockBit ransomware on target networks to evade US sanctions.
Mandiant announced in March that it had entered into a definitive agreement to be acquired by Google for $5.4 billion.
See also: Evil Corp: Switches to LockBit ransomware business to avoid sanctions
The LockBit ransomware gang has been active since September 2019 as ransomware-as-a-service (RaaS) and re-released as LockBit 2.0 RaaS in June 2021.
As cybersecurity firm Sophos in April, a LockBit affiliate hid behind a US local government agency's network for months before deploying the ransomware.
