I've decided what I'll do with the Lockbit 5.0 source code.
If I let it rip it'll become a schizo nerd free for all, Threat Actors will race to it so they can use it. Defenders will race to it to make detections. It'll be a shit show.
I don't want nerds doing a schizo race around the holiday season.
Ultimately, it'll be defenders which get the shaft and get fucked over because it's harder to defend.
I've decided I'll first privately share it with anti-malware vendors, defenders, and Threat Intelligence places. They'll be able to get the most value out of it.
After I give them some time to poke it with a stick I'll open source it in our malware collection repository.
Offensive researchers will probably gain very little from this code. It's interesting, but not super 1337 bleeding edge technology. It is best suited for threat emulation.
I hope though that sometime during this the person who shared the Lockbit 5.0 source code re-establishes contact because I don't know who they are or why they randomly shared this.
It is very confusing.
I'll share it with Mandiant, HuntressLabs, MalwareBytes, RecordedFuture, SentinelOne, Broadcom, CERTs, Palo Alto, CrowdStrike, Cloudflare (if they even give a fuck), ZScaler (if they even give a fuck), TrendMicro, ESET, Sophos, CheckPoint, Microsoft, GData ...
I don't know, pretty much anyone who isn't going to be a scummy fuck about it. Any vendor I publicly share it with I'm going to publicly name so they don't try to pull some shit like "EXCLUSIVE !!! WE HAVE THE THING AND ONLY US!!!!"
Reach out to me and I'll share it. I'll do it on Monday, or something, whenever I get around to it. I'm not doing shit today, dawg.
K love you, bye