LockBit RaaS Reputation Dynamics Revealed at Black Hat Europe 2025

What Happened

Max Smeets of Virtual Rotes presented “Inside the Ransomware Machine” at Black Hat Europe 2025, focusing on LockBit RaaS operations. He cited a 2022‑2024 dataset showing 194 affiliates, 110 of which reached negotiation, and 80 that ultimately paid the gang.

Impact on Victims and the RaaS Model

The LockBit model relies on affiliates to identify, exfiltrate, and encrypt victim data before the gang demands payment. When affiliates succeed, the victim faces a choice: negotiate and pay or endure extended downtime and potential data loss.

Reputation Effects

“Media coverage is higher for companies that pay, turning the story into a narrative of loss of control and eroding trust,” Smeets said.

Conversely, non‑payment can lead to longer disruptions and higher total costs, as seen in high‑profile cases. The dual pressure on victims to protect brand image and financial stability creates a complex decision matrix.

What Defenders Should Do

• Track public sentiment and media reporting on ransomware incidents in your sector.
• Assess the cost of downtime versus ransom payment on a case‑by‑case basis, factoring in potential brand damage.
• Maintain robust incident‑response playbooks that include reputation‑management steps such as transparent communication and third‑party validation.
• Collaborate with law‑enforcement and industry groups to share affiliate‑level threat intelligence.