As we’ve previously covered, Evil Corp’s and Lockbit’s activities have overlapped on-chain. Specifically, rebranded ransomware strains associated with Evil Corp and cryptocurrency clusters belonging to Lockbit have used the same deposit addresses at centralized exchanges, as shown in the below Chainalysis Reactor graph.

Interesting overlap in activities between Evil Corp and Lockbit, as revealed by on-chain analysis. The connection through shared deposit addresses raises questions about potential collaboration or competition in the ransomware landscape.