(Original report) https://www.prodaft.com/m/reports/LockBit_Case_Report___TLPWHITE.pdf
Lockbit’s affiliate usernames (among other data points) were dropped in this recent report. Some of the usernames in the report include “malibudad” and “wallstreet88″(?). I’m not a linguist, but these sound like handles of, well, not Russians. Common assumption is most of these attacks originate from former Soviet countries, but I’m a bit at odds with that after reading this report?
(Note): I get that the names don’t exactly point to some Lockbit affiliate living in say, Malibu. But is there any data to back up writing off that hypothesis?