Overview

• The Unité nationale cyber detained a Ukrainian man in his 30s in Ukraine in mid-July, identifying him as an affiliate of LockBit.
• Authorities allege he carried out several dozen ransomware attacks, including some targeting French organizations.
• Forensic analysis of his computer hardware and phones is underway to trace additional victims and network links.
• LockBit’s franchise structure supplies ransomware to affiliates who conduct attacks in exchange for a share of ransom payments.
• LockBit’s founder, Dmitry Khoroshev, remains at large in Russia under a $10 million U.S. reward, complicating efforts to fully dismantle the network.