THIBER

Today Lockbit ransomware group issued a poll to all of their affiliates. Lockbit is considering implementing new rules for Lockbit affiliates due to their frustration with ransomware negotiators. Currently, Lockbit ransomware group has no rules in place for how much (or how little) affiliates can ransom a company for. They are considering "regulating" ransom demands. They state newer affiliates are giving large discounts to victim companies out of desperation for money, whereas more experienced affiliates do not cave to negotiator's proposed payment from the victims. Lockbit administrative staff are proposing the following options. 1. No changes in payment policy, payment options will remain "unregulated" and remain up to the affiliates. 2. New rules in place which set the minimum payment allowed to be 3% of the victim companies annual revenue with the option of a 50% discount, bringing it down to 1.5% of annual revenue. 3. Establish a new rule where affiliates can only grant a 50% discount of the original ransom price. 4. Establish a new rule where they will not accept a payment below the victims maximum ransomware insurance policy. 5. Establish a new rule where they will accept a minimum payment of 50% of the victims ransomware insurance policy. In regards to this poll, National Hazard Agency, a subdivision of Lockbit ransomware group, has stated they will no longer accept payments below 3% of the companies annual revenue. They will immediately retaliate against any negotiator who approaches them with an offer of less than 3% of the companies revenue. The retaliation will be complete destruction of company data. Image 1. Original Lockbit poll (Russian) Image 2. Lockbit poll (English) Image 3. Message from National Hazard Agency