The $10 Million Question

The FBI doesn’t offer $10 million rewards for petty criminals. That bounty is reserved for terrorists, cartel leaders, and the most dangerous threats to national security.

In 2024, that list includes a ransomware gang called LockBit.

The group has attacked over 2,000 organizations worldwide, extracted more than $120 million in ransom payments, and caused billions in damages. Their victims include hospitals, schools, government agencies, and critical infrastructure.

The FBI wants them badly enough to pay $10 million for information leading to their arrest.

Take the 2-Minute Cybersecurity Assessment: https://centrexit.com/cyber-security-readiness-assessment/

How LockBit Became the World’s Most Wanted

LockBit emerged in 2019 and quickly became the most prolific ransomware operation in the world. Their business model is brutally efficient:

Ransomware-as-a-Service. LockBit doesn’t conduct every attack themselves. They provide the ransomware, the infrastructure, and the negotiation services. “Affiliates” do the actual hacking and split the profits. It’s a franchise model for cybercrime.

Speed matters. LockBit’s ransomware encrypts files faster than competitors. That matters because faster encryption means less chance of detection and interruption. By the time someone notices something’s wrong, the damage is done.

Double extortion. They don’t just encrypt your files—they steal them first. If you won’t pay to decrypt, maybe you’ll pay to prevent your data from being published. They run a leak site where they publicly shame victims and release stolen data.

Professional operations. LockBit runs like a business. They have a bug bounty program offering $1 million to anyone who can identify their leadership. They issue press releases. They provide “customer service” to victims negotiating payments.

The Takedown That Didn’t Stick

In February 2024, law enforcement agencies from ten countries announced Operation Cronos, a major takedown of LockBit infrastructure. They seized servers, arrested affiliates, and even took over the group’s leak site to post taunting messages.

For a few days, it looked like LockBit was finished.

They weren’t. Within days, LockBit had new infrastructure online and was back to attacking victims. Their leader, known by the alias “LockBitSupp,” posted defiant messages mocking law enforcement.

The $10 million bounty is still active because the core leadership remains free.

Why This Matters to Your Organization

You might think ransomware gangs target big fish—major corporations, government agencies, critical infrastructure. They do. But they also target healthcare clinics, school districts, small manufacturers, law firms, accounting practices, and nonprofits.

LockBit affiliates don’t necessarily choose targets strategically. They look for vulnerable organizations—any organization—and exploit them. Your size doesn’t protect you. Your industry doesn’t protect you. Only your security posture protects you.

How LockBit Gets In

Understanding how these attacks happen is the first step to preventing them:

Phishing emails. Still the most common entry point. One employee clicks one bad link, and the attackers have a foothold.

Stolen credentials. Passwords from previous breaches get reused. Credentials bought on dark web marketplaces provide instant access.

Unpatched vulnerabilities. Known security flaws that haven’t been fixed. Attackers scan the internet for vulnerable systems constantly.

Remote access exploitation. VPNs, remote desktop services, and other remote access tools with weak security or known vulnerabilities.

Supply chain access. Compromising a vendor or partner who has legitimate access to your network.

What Makes Organizations Resilient

The organizations that survive ransomware attacks—or avoid them entirely—share common characteristics:

They assume breach will happen. Instead of just trying to prevent attacks, they prepare to survive them. Backups, incident response plans, communication strategies.

They maintain offline backups. Ransomware specifically targets backup systems. If your backups are connected to your network, they’ll be encrypted too. Offline, tested backups are the difference between a bad week and a business-ending event.

They segment their networks. If attackers get into one area, they shouldn’t have easy access to everything. Segmentation limits blast radius.

They keep systems updated. Most ransomware exploits known vulnerabilities with available patches. Regular, prompt patching eliminates the easy entry points.

They train their people. Since phishing is the most common entry point, employees who can recognize and report suspicious emails provide a critical defense layer.

The Reality of the Threat

LockBit is the most prominent ransomware gang, but they’re not the only one. If LockBit disappeared tomorrow, others would fill the gap. The ransomware-as-a-service model has proven too profitable to abandon.

The question isn’t whether ransomware groups will try to attack your organization. The question is whether you’ll be prepared when they do.

The FBI is offering $10 million to stop LockBit. You don’t need $10 million. You need good security practices, tested backups, and a plan for when things go wrong.

Take Our 2-Minute Security Assessment

centrexIT helps San Diego organizations build ransomware resilience before they become targets. If you’re not sure how your organization would survive a LockBit attack, let’s find out together.

Take the 2-Minute Cybersecurity Assessment: https://centrexit.com/cyber-security-readiness-assessment/

Sources

U.S. Department of State — “Reward for Information: LockBit Ransomware as a Service (RaaS)” — Confirms the $10 million reward and details on LockBit’s 2,000+ attacks and $144 million in ransom payments. state.gov

U.S. Department of Justice — “U.S. Charges Russian National with Developing and Operating LockBit Ransomware” (May 7, 2024) — Announces indictment of Dmitry Yuryevich Khoroshev and confirms LockBit targeted more than 2,000 victims, stealing over $500 million.

UK National Crime Agency — “LockBit leader unmasked and sanctioned” (May 2024) — Details on Operation Cronos, the February 2024 international takedown, and data showing 7,000+ attacks between June 2022 and February 2024. nationalcrimeagency.gov.uk

FBI / CISA — Joint Cybersecurity Advisory on LockBit ransomware — Confirms LockBit as the most deployed ransomware variant globally in 2022-2023.

 

The Intruder in Your House 

Imagine someone broke into your house. But instead of stealing something and leaving, they moved into your attic. They came and went through a back window you didn’t know was unlocked. They watched your routines. They went through your files. They copied your keys. 

For 204 days.   Scary right?

That’s not a horror movie scenario. It’s the average amount of time attackers spend inside a compromised network before anyone notices, according to industry research. Nearly seven months of access, observation, and preparation. 

By the time the ransomware deploys or the data theft is discovered, the real damage has been happening for months. 

Take the 2-Minute Cybersecurity Assessment: https://centrexit.com/cyber-security-readiness-assessment/ 

What Attackers Do While You Don’t Know They’re There 

Modern cyberattacks aren’t smash-and-grab operations. Sophisticated attackers are patient. They want to maximize their access before they’re detected. Here’s what happens during those 204 days: 

Days 1-14: Establishing Persistence. The initial breach might happen through a phishing email, a stolen password, or an unpatched vulnerability. But the first thing attackers do after getting in is make sure they can get back in. They create additional accounts, install backdoors, and establish multiple pathways into the network. If you find and close one door, they still have three more. 

Days 15-60: Reconnaissance. Now they start exploring. What systems are connected to what? Where is the sensitive data stored? Who has administrative access? What backup systems exist, and how are they connected? They’re building a map of your entire infrastructure—often a better map than your own IT team has. 

Days 61-150: Privilege Escalation. With their map in hand, attackers work on getting more access. They capture credentials. They exploit misconfigurations. They move from a regular user account to an admin account to a domain admin account. By the time they’re done, they often have more access than your CEO. 

Days 151-204: Preparation. Now they’re ready. They’ve identified your backup systems and figured out how to disable them. They’ve located your most sensitive data and started quietly exfiltrating it. They’ve positioned ransomware across your network, ready to encrypt everything simultaneously. They’re just waiting for the right moment. 

Why Detection Takes So Long 

If attackers are active in your network for seven months, why doesn’t anyone notice? Several reasons: 

They look like normal users. Attackers use legitimate credentials and legitimate tools. To your security systems, they look like an employee logging in and doing their job. 

They’re patient. They don’t move large amounts of data at once. They don’t make sudden changes. They work slowly enough that nothing triggers alarms. 

Most organizations don’t look. Many companies don’t have 24/7 security monitoring. They don’t have systems that correlate unusual activities. They don’t have people actively hunting for threats. If no one’s looking, no one finds anything. 

The Real Cost of Dwell Time 

Every day an attacker spends in your network increases the eventual damage. Research consistently shows that breaches with longer dwell times cost significantly more to remediate. 

Longer dwell time means more data exfiltrated, more systems compromised, more credentials stolen, more backdoors installed, more complete knowledge of your environment, and more leverage for extortion. 

An attacker who’s been in your network for a week has stolen some data. An attacker who’s been there for six months has stolen everything worth stealing and knows exactly how to hurt you most. 

How Organizations Reduce Dwell Time 

The good news: 204 days isn’t inevitable. Organizations that actively hunt for threats and monitor for suspicious behavior can reduce dwell time to days or even hours. Here’s what makes the difference: 

1. Continuous monitoring. Not just logging events, but actively analyzing them. Looking for patterns that indicate compromise. Someone watching the watchtower, not just recording who comes and goes. 
2. Behavior analysis. Knowing what normal looks like so you can spot abnormal. When an account that usually logs in from San Diego suddenly logs in from overseas at 3 AM, someone should notice. 
3. Network segmentation. Making it harder for attackers to move laterally. Even if they get into one area, they shouldn’t have easy access to everything. 
4. Regular threat hunting. Not waiting for alerts, but actively looking for signs of compromise. Assuming attackers are already in and trying to find them. 
5. Incident response readiness. When something suspicious is found, having the ability to investigate quickly. A potential indicator of compromise investigated in hours is a contained incident. One that sits in a queue for weeks is a full-blown breach. 

The Question You Should Ask 

Right now, someone might be in your network. They might have been there for weeks. For months. You’d have no way of knowing. 

The question isn’t whether you’ve been breached. The question is: if you had been breached, how would you know? 

If you don’t have a good answer, that’s where you start. 

Take the 2-Minute Cybersecurity Assessment: https://centrexit.com/cyber-security-readiness-assessment/ 

centrexIT helps organizations understand what’s happening in their networks and reduce the time attackers can operate undetected. If you’re not sure whether you’d know if someone was in your systems right now, let’s find out together. 

 

The Access That Outlived the Employment 

Kandula Nagaraju was terminated in October 2022 for poor performance. His last day at NCS, a major IT services company in Singapore with over 13,000 employees, was November 16, 2022. 

His access to company systems sho offboarding, access management, insider threat, identity management, employee termination should have ended that day. It didn’t. 

In January 2023, Nagaraju logged in remotely. Then again in February. Then thirteen more times in March. He wasn’t checking email or grabbing personal files. He was writing and testing deletion scripts. 

On March 18-19, 2023, he executed them. One hundred eighty virtual servers disappeared. 

The cost estimate: $678,000. His sentence: two years and eight months in prison. 

Take the 2-Minute Cybersecurity Assessment: https://centrexit.com/cyber-security-readiness-assessment/ 

The Seven-Day Problem 

Most organizations have an offboarding process. HR sends a notification. IT is supposed to disable accounts. Badges get deactivated. Laptops get returned. 

But research consistently shows that former employee access persists far longer than it should. Sometimes it’s oversight. Sometimes it’s process failure. Sometimes no one knows all the systems a person could access. 

Nagaraju had been a QA team member with access to testing systems. No one thought to check whether his administrator credentials still worked months after his termination. 

What Former Employees Still Have Access To 

The obvious systems get locked quickly: email, primary login, badge access. But what about: 

• Cloud services with separate logins? That project management tool. The shared document platform. The analytics dashboard. Each might have its own credentials that nobody remembered to revoke. 
• Shared accounts and passwords? The generic login everyone uses for that one system. The admin password that hasn’t changed in years. The “emergency access” credentials written on a sticky note. 
• Personal devices with company data? If someone had company email on their phone, did they remove it? If they saved files locally, do they still have copies? 
• Third-party access? Could they still log into a vendor portal using their company credentials? Could they still approve purchases or access financial systems? 
• VPN and remote access? Nagaraju didn’t walk into the NCS office. He connected remotely, six times over several months, without anyone noticing. 

Why This Keeps Happening 

Offboarding failures aren’t usually malicious. They’re systemic: 

• No single source of truth. HR knows what departments someone worked in. IT knows what computers they used. But no one has a complete picture of every system and every credential a person accumulated over years of employment. 
• Shadow IT creates blind spots. When employees sign up for tools without IT approval, those tools aren’t on any offboarding checklist. IT can’t revoke access to systems they don’t know exist. 
• Separation is often rushed. Involuntary terminations happen quickly. The focus is on legal compliance and security escorts, not methodical access reviews. 
• Verification rarely happens. Someone checks a box saying access was revoked. Did anyone actually verify it worked? Did anyone try logging in with those credentials to confirm they were disabled? 

The Damage Former Employees Can Do 

Nagaraju deleted test servers. It could have been worse. Former employees have stolen customer data before competitors hired them, deleted years of work to sabotage projects, downloaded proprietary information to start competing businesses, shared credentials with outsiders seeking access, installed backdoors for future access, and held data hostage until severance disputes were resolved. 

The common thread: all of them still had access after they shouldn’t have. 

Fixing the Seven-Day Problem 

The goal is simple: within seven days of any departure, a former employee should have zero access to any company system. Achieving that requires: 

• A complete access inventory. You can’t revoke access you don’t know exists. Document every system, every shared credential, every third-party platform that employees touch. 
• Automated offboarding triggers. When HR processes a termination, that should automatically trigger access revocation across all systems—not create a ticket that sits in a queue. 
• Separation of duties. The person who has access to critical systems shouldn’t be the only person who knows they have that access. Administrative credentials should be documented and managed centrally. 
• Verification testing. Don’t just disable accounts. Test that they’re actually disabled. Try logging in. Confirm the door is actually locked. 
• Regular access reviews. Don’t wait for departures. Periodically audit who has access to what. You’ll find active credentials for people who left years ago. 

The Question for Your Organization 

Think about the last person who left your organization. Could you list every system they had access to? Every shared password they knew? Every cloud service they’d signed up for? 

If someone from your organization was terminated today and wanted to cause damage next month, what could they still access? 

Take the 2-Minute Cybersecurity Assessment: https://centrexit.com/cyber-security-readiness-assessment/ 

centrexIT helps organizations build offboarding processes that actually work. If you’re not sure what a former employee could still access, let’s find out together. 

Sources 

BleepingComputer: “Former IT employee gets 2.5 years for wiping 180 virtual servers” (June 2024) 

Tom’s Hardware: “Disgruntled ex-employee costs company over $600,000 after he deletes all 180 of its test servers” (June 2024) 

CNA (Channel News Asia): “Man jailed for deleting 180 virtual servers after being fired from IT job” (June 2024)