losttrust

Executive Summary

LostTrust is a double-extortion ransomware group that emerged in March 2023, rapidly targeting sectors including manufacturing, professional services, construction, and education. The group gained notoriety by publicizing over 50 victims within days of launching their leak site (September 2023) and is suspected to be a rebrand of the MetaEncryptor gang.

Goals & Targeting

LostTrust targets sectors where sensitive data and intellectual property are abundant, such as manufacturing and professional services, enabling both financial gain and organizational disruption. Their geographic focus on the US may stem from higher ransomware success rates in English-speaking regions and easier access to high-value targets.

LostTrust operates as a double-extortion ransomware group, leveraging both encrypted data and stolen information for maximum pressure on victims. The group primarily targets manufacturing, professional services, construction, and education sectors, with the majority (71%) of known victims located in the US. Emerging from March 2023, LostTrust gained significant attention by swiftly publicizing victim data after encrypting it, which is a hallmark of their double extortion tactics. The group's recent operations suggest a focus on inducing fear through rapid leak site deployment, targeting industries that may have sensitive data or are more likely to comply with extortion demands.

Key Capabilities

• Double extortion tactics
• Ransomware deployment
• Encryption of files with .LT extension
• Victim data leak via dedicated site
• Targeting critical infrastructure sectors

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

LostTrust's campaigns demonstrate a rapid victim acquisition strategy, leveraging aggressive phishing and double extortion. Notable operations include the targeted attack on educational institutions, possibly exploiting开学季 vulnerabilities. The group's operational tempo suggests a decentralized approach, with a focus on high-impact targets to maximize financial gain quickly.

IOC Patterns

• Phishing emails with malicious links or attachments
• Encrypted files renamed with .LT extension
• C2 infrastructure using compromised domains and coin mixers

Recommended Actions

• Implement robust backup solutions isolated from the network
• Monitor for Suspicious encryption activities
• Educate employees on phishing awareness
• Segment critical systems to limit ransomware spread
• Establish incident response playbooks for potential extortion events
• Collaborate with law enforcement for tracking leak sites and threat actors

Suggested Tags