The May 7th LockBit chat leak that circulated widely in the tech press offers a rare look into the inner workings of LockBit 4.0, a major Ransomware-as-a-Service (RaaS) group. The data includes onboarding instructions, victim chat logs, and internal earnings reports, shedding light on the group's global ransomware operations.
ByteOps conducted an in-depth analysis of the leaked SQL database, reviewing all ransom-related chats (from Dec 19, 2024 to Apr 29, 2025) and cross-referencing Bitcoin addresses. This revealed consistent 20% commission payments to specific wallets, confirming centralized profit-sharing and the operator's financial control within the RaaS structure.
From Initial Breach to Data Leak
LockBit follows a structured and repeatable pattern that reflects the group's maturity as a RaaS operation. Most incidents begin with a breach of external-facing services, such as RDP or VPN gateways, or via compromised credentials. Once access is gained, the attackers escalate privileges and move laterally, often targeting backup servers and domain controllers to increase leverage.
At a chosen time, often outside business hours, LockBit deploys its payload. LockBit 4.0 is designed to encrypt files rapidly and render systems unusable within minutes. The ransom note directs victims to dedicated .onion sites on Tor, portrays the attack as a "penetration test", and instructs victims not to contact law enforcement. In addition to encryption, sensitive data is typically exfiltrated beforehand, a dual-extortion approach that threatens publication on public leak sites if the ransom is not paid.
The negotiation itself follows recurring phases: initial contact via the ransom note, opening a chat on the LockBit onion site, a ransom demand in cryptocurrency, negotiation and pressure, proof of decryption on a sample file, payment, and an aftermath in which the attacker may even offer "support".
| Phase | Description |
|---|---|
| Initial Contact | Victim finds a ransom note with instructions to contact the attacker. |
| Opening the Chat | Communication is established via a dedicated chat on the LockBit onion site (dark web). |
| Ransom Demand | Attacker demands a ransom amount, often in cryptocurrency. |
| Negotiation | Victim may bargain for a lower price or more time; attacker may apply pressure. |
| Proof of Decryption | Attacker may decrypt a sample file to prove they can restore the data. |
| Payment | If agreed, victim pays and receives the decryption tool (not always reliable). |
| Aftermath | Victim uses the tool; attacker may offer support. |
Time Pressure and Discounts: The Psychology of Extortion
A recurring pattern in the leaked chat logs is the strategic use of time pressure. Victims are pushed to decide fast, with operators dangling limited-time offers, claiming they cannot discount without "risking termination", then suddenly producing reductions of up to 30%. Two pressure points dominate: the fear of permanent data loss, and the threat of public exposure through double extortion.
When negotiations stall, the illusion of affiliate autonomy is dropped and the operator, known simply as "boss", enters the conversation. This reveals a centralized power structure: the operator has full visibility and override permissions on all affiliate negotiations, with the authority to join chats, adjust demands and close deals.
"Welcome to the Platform": Crime as a Subscription
The LockBit affiliate program functions not unlike a SaaS onboarding page, tailored for cybercriminals. Affiliates willing to pay a registration fee of $777 in Bitcoin are granted access to a control panel where they can build Windows, ESXi and Linux payloads and manage victim negotiations. New affiliates are instructed to use cryptocurrency mixers or "dirty bitcoins" for payment, with access granted immediately after payment.
Some Numbers Behind the Extortion
According to the dataset, LockBit affiliates engaged with at least 120 victims. Of those, 18 paid, roughly 15% of known cases. Despite the low conversion rate, the group generated significant profits: $2,277,930 demanded, with $1,822,344 in affiliate earnings and a $455,586 operator cut. Profit concentrates among a few successful cases, particularly where demands reached six- or seven-figure sums. The model remains sustainable even with high failure rates.
| Outcome | Victims | Total Demanded (USD) | Affiliate Earnings | Operator Cut |
|---|---|---|---|---|
| Paid | 18 | $2,277,930 | $1,822,344 | $455,586 |
| Unpaid | 102 | $9,956,590 | — | — |
| Total | 120 | $12,234,520 | — | — |
Across 17 precisely tracked cases, the average negotiation lasted 10.65 days (shortest 2, longest 32), with an average ransom paid of roughly $111,431 (heavily skewed by a single $2M payment). On their public leak page, 515 non-paying victims are listed alongside exposed data. These timelines show ransomware operations are closer to hostile negotiations than smash-and-grab crimes.
Security Weaknesses Exposed: A Masterclass in IT Failures
LockBit's affiliates often taunted victims by pointing out glaring flaws, almost free consulting. The leaked chats read like an audit report, with the attackers themselves naming the gaps that let them in:
| Category | Vulnerability | Description | Quotes from the leaked chats |
|---|---|---|---|
| Access Management | Weak passwords | Passwords were easy to guess or overly simple. | "you had easy passwords", "weak passwords everywhere" |
| No regular password changes | Lack of policy to enforce password rotation. | "you need to change all Windows account passwords without exception" | |
| Domain admin compromised | Attackers discovered and used a domain admin account. | "then we found the admin in the domain" | |
| Reuse of local admin credentials | Same local admin credentials used across hosts. | "during NTLM local admin access we found the same in the domain" | |
| Network Security | Open admin ports | Admin-related ports were exposed and not filtered. | "close the ports & the admin" |
| No network monitoring or traffic analysis | Suspicious activity was not detected early. | "look for unnecessary activity on the network (track traffic)" | |
| System & Patch Management | Outdated software and systems | No update or patching strategy in place. | "keep up to date with the updates of the products you use", "we got into your network through a vulnerability in your Fortinet" |
| No system hardening | Systems lacked secure configuration. | "the domain is not a secure infrastructure", "everything in the domain is not safe" | |
| Application Security | Uncontrolled use of AnyDesk | AnyDesk was used by attackers to regain access. | "you had AnyDesk installed on many hosts, we just used it to get back" |
| Execution of unverified third-party software | Software run on machines without AV protection. | "test-run third-party software on machines without antivirus software" | |
| Lack of antivirus on all servers | Not all servers had AV / EDR / XDR protection. | "install antivirus on all servers without exception" | |
| Kaspersky server in domain | Highlighted as a potential risk by the attackers. | "you have a Kaspersky server in your domain, remove it" | |
| Backup & Recovery | Backup systems in the domain | Backup systems were domain-joined and vulnerable. | "don't manage backups in the domain" |
| Single NAS for backups | No redundancy, single point of failure. | "one NAS is not enough for backups, it is very unreliable" | |
| No off-domain or segregated backups | Backups were not isolated from the domain. | "2 NAS backup we do not go to it from the domain" | |
| Organizational Weaknesses | No segmentation between admin and user systems | Enabled lateral movement across the network. | "he managed backups and his host is in the domain, so admin it was not difficult to get him" |
| Poor administrative account hygiene | Admin systems were poorly secured. | "host admin needs to be removed from the domain" | |
| Phishing / missing cybersecurity awareness | Users were tricked via phishing, the initial access vector. | "got to you through phishing", "random phishing through the manager" | |
| Lack of control over remote access tools | AnyDesk was present and accessible to attackers. | "you had AnyDesk installed on many hosts" |
Conclusion
The leak offers a rare and unsettling view into industrialized cyber extortion. But beyond technical sophistication, the data tells a deeper story of human failure, systemic weakness and missed opportunity. Many organizations weren't brought down by zero-days, but by predictable, preventable gaps: weak passwords, unpatched software, permissive networks and unsegmented domains. Backups were domain-joined and just as vulnerable as production data.
No single product solves a problem that is ultimately cultural and structural. Organizations must shift from reactive patchwork to proactive resilience: enforce credential hygiene, patch continuously, harden to industry benchmarks, isolate critical assets and backups from the main domain, train people continuously, and invest in detection, response and recovery that assume breach rather than hope to avoid it. Cybersecurity, at its core, is not about perfection, it's about preparation. It is not a checklist; it is a discipline.
