Lockean Group Cripples Multiple French Companies

About Lockean

• In the last one and half years, the ransomware group attacked the networks of eight French companies and stole data before spreading malware to various victims.
• Some of the targeted businesses included Gefco (a transport company), the Ouest-France (a newspaper), and Fareva and Pierre Fabre (pharmaceutical).
• Four additional unnamed companies were identified as victims by ANSSI, France’s national cybersecurity agency, and two incidents were noted by Intrinsec and the DFIR Report.
• Lockean’s average cut of paid ransoms stands at 70% while the rest goes to RaaS maintainers.

Attack tactics

• In most of the attacks, attackers gained initial access to the victim network via the Qbot banking trojan, which distributed multiple ransomware strains.
• In one instance, the group used IcedID to get access to the network. For lateral movement, the attackers used Cobalt Strike and Adfind, BloodHound, and BITSadmin tools.
• Looking at the IoCs, several IP addresses related to Conti ransomware have been found, implying Lockean’s connection with other RaaS operations focused in different regions. Furthermore, to increase profits, the gang used double extortion and stole data from the victim using the Rclone tool.

Conclusion