The FBI urges LockBit ransomware victims to reach out after getting 7,000+ decryption keys to recover data for free; police seized 2,500+ keys in February 2024
Sergiu Gatlan / BleepingComputer :
Context & Ripple Effects
This expands the LockBit disruption that previously produced operator arrests, warrants, a public decryptor, and crypto-wallet seizures in February. The FBI is now turning recovered access into a victim-recovery channel through the earlier LockBit takedown operation.
It also fits an established law-enforcement playbook: the FBI previously derived hundreds of Hive decryptors, while a broader public-private effort released a GandCrab recovery tool. The Hive key-recovery effort shows that seized infrastructure can reduce victims’ pressure to pay.
First-order effects
- LockBit victims that can obtain a matching key from the FBI may restore encrypted data without paying a ransom.
- The FBI becomes an active recovery intermediary, requiring affected organizations to contact the agency rather than rely solely on their own incident-response and backup processes.
Second-order effects
- Free recovery keys weaken LockBit operators’ leverage over victims whose infections are covered, potentially reducing the pool of organizations that see payment as their fastest path to restoration.
- The case reinforces incentives for victims and security providers to preserve ransomware evidence and engage law enforcement, since intelligence or seized infrastructure can yield recovery options after an attack.
Third-order effects
- If repeated across major ransomware operations, key recovery makes disruption campaigns more economically consequential: authorities can target both operators and the coercive value of encrypted data.
- The longer-term limit is coverage: decryptors help only victims using the affected LockBit variants and keys, so resilient backups and incident response remain necessary alongside takedowns.
The trend: Ransomware enforcement is increasingly measured not only by arrests and infrastructure seizures, but by whether recovered access can return data to victims and erode extortion economics.