In what might be a first, a ransomware gang has launched a bug bounty program designed to reward anyone who submits details on previously unknown website vulnerabilities to the group.
The program comes from the LockBit, one of the most prolific ransomware gangs on the scene today. On Sunday, malware-repository site VX-Underground noticed the LockBit gang had launched the bug bounty program at a dark web address.
"We invite all security researchers, ethical and unethical hackers on the planet to participate in our bug bounty program," the hacking group wrote. "The amount of remuneration varies from $1000 to $1 million."
Specifically, LockBit is looking for website vulnerabilities it can manipulate and use to steal data. The group is also interested in learning about bugs in its own ransomware encryption programs and in the Tox messenger and Tor network.
However, the biggest payout has nothing to do with uncovering software flaws. LockBit is offering $1 million to anyone—including FBI agents—who can “dox” or uncover personal details about the gang’s leader.
The bug bounty program suggests LockBit is rich enough to buy zero-day exploits, or attacks capable of leveraging unknown software flaws to hack a computer system. Zero-day exploits can be particularly devastating because there’s no software patch a user can install to thwart the attack. In addition, LockBit is promising payouts that can rival the rewards from legitimate bug bounty programs.
LockBit's program is certainly a worrying sign. Its own ransomware site claims the gang has hacked dozens of companies and organizations across the globe. Victims who refuse to pay the ransom have had their internal files leaked on LockBit’s website.
According to Trend Micro, the gang also previously recruited company insiders to help them hack a target’s network. “LockBit has been detected all over the globe, with the US seeing most of the attack attempts from June 2021 to January 20, 2022, followed by India and Brazil,” the security firm wrote in a February report. “We saw the most LockBit-related detections in the healthcare industry followed by the education sector.”