Pierluigi Paganini June 06, 2022

LockBit ransomware gang claims to have hacked the cybersecurity firm Mandiant, which is investigating the alleged security breach.

Today the LockBit ransomware gang has added the cybersecurity firm Mandiant to the list of victims published on its darkweb leak site. Mandiant is investigating the claims of the ransomware gang, the cybercrime group declared to have stolen 356841 files from the company and plans to leak them online.

The gang plans to release the stolen files on 06 June, 2022 at 22:35:00.

The alleged stolen documents appear to have been included in an archive named ‘mandiantyellowpress.com.7z.’ At this time, the domain mandiantyellowpress[.]com redirects users to the site ninjaflex[.]com that displays the images of a ninja and a flex.

Early this month, Mandiant published a report claiming that the cybercrime gang Evil Corp switched to LockBit 2.0 ransomware to evade sanctions.

A Mandiant’s statement published by several websites states that the company was aware of the claims, but “at this point, we do not have any evidence to support their claims. We will continue to monitor the situation as it develops.”

Update:

Time is up while I was writing the post … let’s see what happens and if they will publish something.

Security Affairs is one of the finalists for the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS. I ask you to vote for me again (even if you have already done it), because this vote is for the final.

Please vote for Security Affairs and Pierluigi Paganini in every category that includes them (e.g. sections “The Underdogs – Best Personal (non-commercial) Security Blog” and “The Tech Whizz – Best Technical Blog”)

To nominate, please visit: 

https://docs.google.com/forms/d/e/1FAIpQLSdNDzjvToMSq36YkIHQWwhma90SR0E9rLndflZ3Cu_gVI2Axw/viewform

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Lockbit)

[adrotate banner=”5″]

[adrotate banner=”13″]