Thread by @AShukuhi

A major civil war going on the Russian cyber-criminal underground between the #Lockbit #Blackmatter #ransomware groups and other threat actors! @TalosSecurity

After alleging for a long time that Kajit, the former owner of RAMP is a cop, LockBittSupp posted a massive bombshell t0 XSS(DaMaGe LaB) Russian hacking forum

LockBitSupp (#lockbit #ransomware) just shared proof of conversations between vx-underground and Kajit proving that Kajit was the one who leaked the BlackMatter admin panel. What is interesting is that the admin panel was shared with wazawaka/boriselicin

wazawaka/boriselcin is a prolific ransomware operator that we interviewed blog.talosintelligence.com/2021/02/interv… tied to LockBit, BlackMatter among other RaaS partnerships. He has admitted to several ransomware attacks.

The leaked conversations are between LockBitSupp and Kajit, Kajit and a username named smelly from presumably vx-underground, between a self described #0day broker Kelegen and smelly and arbitration between boriselcin, admin, kajit and LockBitSupp on XSS.

in the conversations between LBS and vx-underground LBS wanted vx to claim that #revil was the one who leaked it to him

S this implies that Kajit leaked a #BlackMatter panel that was only shared between him and wazawaka/boriselcin/uhodi with the intent to implicate REvil. LBS figured all of this out and in the process has proved himself to be a determined investigator collecting evidence 4 months

smelly insisted with Kajit that their purpose with them is to only collect and share information and to remain neutral. They did not appear to be a part of any coordinated actions with Kajit based on the screenshots. The timing of the screenshots is in line with vx's posts abt BM

In total, there were 30 + screenshots in both Russian and English shared by LockBitSupp. What is interesting to this linguist is the several snippets of perfect colloquial and conversational English demonstrated by LockBitSupp while at the same time clearly speaking native Rus.

All of this has been brewing for about 8 months (since #revil shut down) but three things have finally forced a spillover:
1. #revil arrests in January
2. Reintroduction of convicted spammer Peter Severa aka Severa into the XSS forum last week.
3. wazawaka's insane video rant