LockBit3 ransomware group lists frilot.com on its leak site

• Ransomware group: LockBit3
• Country: United States
• Sector: Professional Services
• Announcement date: July 31, 2024

The LockBit3 ransomware group has listed the law firm frilot.com on its leak site. Through a post on its dedicated platform, the group claims to have carried out a cyberattack against the institution, alleging that data was exfiltrated during the incident.

Details of the claimed attack

The announcement regarding frilot.com was added to the LockBit3 leak platform on July 31, 2024. According to the information provided by the group, the actual attack is claimed to have taken place on May 29, 2024. This discrepancy between the attack date and the announcement date is a common occurrence in ransomware operations, where groups may hold stolen data for a period of time before making a public announcement to increase pressure on the victim.

Ransomware leak sites function as a tool for double extortion, a tactic where threat actors not only encrypt an organization's systems but also steal sensitive data. The threat actors then threaten to publish this information on these public platforms if a ransom is not paid. This method aims to maximize leverage by threatening the victim's reputation and legal standing through the exposure of private information.

Data involved in the incident

No details regarding the nature of the leaked or threatened data have been shared by the group. The provided screenshot associated with the listing displays only a general verification page of the leak site, and the listing names no specific data types.

Organization profile

Frilot LLC is a law firm based in New Orleans, Louisiana. It provides full-service legal representation in all areas of litigation on a local, regional, and national basis.

Potential impact and assessment

As a law firm, the alleged leaked data may contain sensitive client confidentiality and proprietary business information. Such a breach could lead to significant reputational damage and potential legal liabilities toward the firm's clients. Given that the institution is based in the United States, it may be subject to state-level data breach notification laws and relevant regulatory requirements.

Considering the known methods of the LockBit3 group, the publication of such data could create secondary risks, including identity theft or targeted phishing attacks. LockBit3 is a Ransomware-as-a-Service (RaaS) structure that has been active since 2019. Despite previous operational disruptions, the group is assessed to remain capable of reorganization and continued activity.

In the professional services sector, organizations often face heightened risks due to the sensitive nature of the information they handle. To mitigate these risks, organizations typically focus on robust defensive measures. These include implementing multi-factor authentication across all access points, maintaining rigorous patch management schedules to close vulnerabilities, and conducting regular employee training to recognize phishing attempts. Furthermore, maintaining offline or immutable backups is a critical component of a resilient cybersecurity posture, allowing for recovery in the event of a successful encryption attack.

Summary of the threat actor

The LockBit3 group operates as a RaaS, a model where developers provide ransomware tools to affiliates who then carry out the actual attacks. This structure allows the core developers to focus on the sophistication of the malware while the affiliates handle the deployment and negotiation. This model has contributed to the group's ability to remain active and reorganize even after law enforcement actions or operational disruptions.