LockBit ransomware returns, restores servers after police disruption

LockBit has relaunched its ransomware operation on new infrastructure less than a week after law enforcement disrupted its servers, acknowledging that an outdated PHP instance (CVE-2023-3824) enabled the breach; the gang says some decryptors and panels were seized but has moved its leak site, listed victims, and announced plans to decentralize affiliate panels, tighten decryptor protections, and increase focus on government targets.