LockBit released version 3.0 of the eponymous virus in June 2022 and with it introduced its own hijacker bug bounty program that offers money to other attackers for interesting vulnerabilities. This week, known as a researcher 3xp0rt, reportedTwitter user Ali Qushji, who recently signed up, claims he and his team hacked LockBit’s servers and discovered a crypto generator there, and he hastened to make it public.

Another version of events

• A prominent IT professional, vx-underground, confirmed on September 10 that a user nicknamed protonleaks had contacted them and shared a copy of the same creator.
• Official representative of the group LockBit claims there were no hacks, and the custom builder isn’t happy with the management of the “developer for hire” hack group..
• Bleeping Computer asked the opinion of a few more experts, and they all confirmed that the builder was genuine.

Journalists warn that whatever the source of this leak, the release of the LockBit 3.0 creator online will increase the number of extortion attacks. After all, the generator allows criminals to quickly create the necessary executables (including the encryptor and decryptor itself, as well as special tools) to launch their own campaigns.

The tool published online consists of four files: an encryption key generator, the generator itself, a changed configuration file, and a batch file to generate all the files. Yes, the config.json file can be used to configure the encryptor, including changing the ransom note, changing configuration options, listing processes and services to terminate, and even specifying the control server to which the virus will send data. So no hacker can prevent the pest from adapting to its infrastructure.