Law enforcement authorities, in collaboration with the National Crime Agency in the UK, have disrupted the development of a new version of the LockBit ransomware named LockBit-NG-Dev. This development was intercepted earlier this week when the cybercriminal infrastructure was taken down. As a result, cybersecurity company Trend Micro was able to analyze a sample of the latest LockBit version, which has the potential to become LockBit 4.0.

The new LockBit variant, still in development stages, differs from previous versions as it is written in .NET rather than C/C++. Trend Micro states that the malware is compiled with CoreRT and packed with MPRESS. Notably, the malware includes a configuration file in JSON format outlining various execution parameters, such as the execution date range, ransom note details, unique IDs, RSA public key, and other operational flags.

Despite missing some features present in earlier versions, such as the ability to self-propagate in breached networks and print ransom notes on victim's printers, the new encryptor appears to be nearing completion, offering most of the expected functionality. Additionally, it includes a self-delete mechanism that overwrites LockBit's file contents with null bytes.

Trend Micro has released a detailed technical analysis of LockBit-NG-Dev, shedding light on the full configuration parameters of the malware. This discovery marks a significant setback for LockBit operators, impacting their operations through Operation Cronos. With the source code of the encrypting malware now known to security researchers, restoring the cybercriminal business is expected to pose a formidable challenge for the gang still controlling backup servers.