LockBit Ransomware Group Suffers Data Breach

LockBit, the once prolific Ransomware-as-a-Service (RaaS) operation that was significantly disrupted by international law enforcement in 2024, suffered yet another setback, this time as the result of a data breach that exposed the core infrastructure behind the criminal enterprise. The group’s dark web platforms, including administrative and affiliate control panels, were reportedly compromised, and all LockBit’s admin panels now display the message “Don’t do crime, CRIME IS BAD xoxo from Prague,” along with a link to download a file named “paneldb_dump.zip,” containing a MySQL database dump of the group’s internal data. Like the information exposed by law enforcement in 2024, this latest breach provides more insight into LockBit’s operations, offering valuable intelligence for cybersecurity professionals and law enforcement.
 

What’s Notable and Unique

• A preliminary analysis of the leaked LockBit ransomware database revealed an extraordinary level of insight into the group’s internal operations. The SQL dump, created on April 29, 2025, was extracted from a local development environment running MySQL Server version 8.0.41 on Ubuntu 22.04.1, suggesting it was likely a working backend server used by the group.
• This leak includes 20 database tables, several of which are especially revealing. Notably, the ‘btc_addresses’ table lists nearly 60,000 Bitcoin wallet addresses believed to be tied to ransom payments, highlighting the massive scale and financial infrastructure behind LockBit’s RaaS model.
• Among the more technically informative tables are ‘builds’ and ‘builds_configurations,’ which provide evidence of how LockBit affiliates generated custom ransomware payloads for specific targets. Some entries even list company names of intended victims. The ‘builds_configurations’ table details technical options used during attacks, such as which ESXi servers to avoid or which file types to encrypt, indicating a high level of sophistication and operational flexibility. These insights may assist defenders in understanding LockBit’s tactics and preparing more targeted defenses.
• Equally compelling is the ‘chats’ table, which contains 4,442 negotiation messages between LockBit operators and their victims, dating from December 19, 2024, to April 29, 2025.
• Additionally, the ‘users’ table lists 75 individuals with access to the affiliate panel, including admins and affiliates. The passwords are stored in plaintext, revealing usernames and weak passwords such as “Lockbitproud231.”

 

Analyst Comments

 
The latest breach of LockBit’s infrastructure is yet another destabilizing event for what used to be one of the most prolific ransomware groups in the world. Despite surviving previous blows, including the major disruption caused by Operation Cronos in early 2024, this new incident exposes deep vulnerabilities within the group’s internal security and could erode the trust of its remaining affiliate base, which is central to the success of its RaaS model. The defacement and leak of LockBit’s MySQL database, which includes nearly 60,000 Bitcoin wallet addresses, detailed malware builds, affiliate configurations, and thousands of extortion chat messages, marks an extraordinary breach of secrecy. The fact that sensitive data such as user credentials were stored in plaintext further suggests operational complacency. While ‘LockBitSupp’ has downplayed the breach by confirming that no private keys or critical data were lost, the exposure of internal tools and communications will likely deter both current and prospective affiliates and could make it easier for law enforcement and researchers to map out LockBit’s tactics and ecosystem.
 

Sources

• When Hackers Get Hacked: Analyzing the Breach of LockBit
• LockBit Ransomware: From Cybercriminal Glory to a Critical OPSEC Failure
• LockBit ransomware gang hacked, victim negotiations exposed
• GitHub – D4RK-R4BB1T / Criminal Leaks