The dual-target claim: Nigeria's LNRBDA and Amazon Web Services
On January 24, 2025, the ThreatMon intelligence team identified ransomware activity on the dark web attributed to the GDLockerSec group. The operation involved two distinct claims of compromise issued within minutes of one another: the first at 16:42:39 UTC and the second at 16:47:03 UTC. The victims named in these posts were the Nigerian government agency LNRBDA, identified by its domain lnrbda.gov.ng, and Amazon Web Services (AWS), a major global cloud computing platform.
The proximity of the timestamps suggests a coordinated release of data or claims rather than separate operational incidents. While the group asserted control over systems belonging to both a public sector entity and a private technology giant, independent analysis by KELA Cyber has challenged the validity of the AWS-related allegations. Their investigation determined that the files purportedly leaked from Amazon’s infrastructure originated from an open-source S3 bucket, indicating that the data was publicly accessible rather than stolen through a security breach.
Debunking the AWS breach: S3 bucket misconfiguration
KELA Cyber’s forensic review of the files attributed to Amazon Web Services revealed that the data originated from a publicly accessible S3 bucket rather than stolen infrastructure. By comparing the sample file released by GDLockerSec against an open-source counterpart, investigators found the content to be identical, confirming that the material was freely available on the internet prior to the alleged leak.
The analysis concludes that there is no evidence of a security incident or breach at AWS. The group’s claim of compromising Amazon’s systems is therefore unfounded, with the data in question having been sourced from an open repository rather than extracted through malicious intrusion.
GDLockerSec's origins and operational profile
GDLockerSec emerged in January 2025 as a ransomware operation that initially operated under the alias GhostSec-Devil. The group established its presence through an onion website, adopting infrastructure and communication methods typical of larger ransomware entities. Its digital footprint includes a Tox chat ID used for direct contact with potential victims or affiliates.
The group’s online activity is heavily concentrated on Telegram, where user @Admfudhsvdg (ID 6527700340) has actively promoted the operation within data breach communities. This individual previously used the username @GDLockerSec and maintains a history of rotating aliases, including @vfsstart, @Bodasec, @vth3darkly, @tradervalide, and @ghostsadmines. Investigations indicate the operator may go by the first name Amin. The group’s reach extends beyond Telegram into Arabian Facebook groups, such as Moroccan Hackers, where inactive profiles linked to the operation have been identified. A message posted in December 2024 within these communities explicitly described the entity as a group targeting computers with ransomware and directed users to contact specific handles for engagement.
Assessment of threat sophistication and credibility
KELA Cyber characterises GDLockerSec as an amateur operation that relies on exaggerated claims to inflate its standing within the cybercrime ecosystem. The group’s assessment suggests a fundamental lack of sophistication, with tactics that appear to be copied from more established ransomware entities such as RansomHub rather than developed through independent technical innovation. This reliance on imitation and inflated victim lists points to poor operational security and an inability to execute complex intrusions independently.
The contrast between the group’s bold targeting of high-profile entities, including a government agency and Amazon Web Services, and its actual technical capability is stark. The debunking of the AWS breach—where data was traced to a publicly accessible S3 bucket rather than stolen infrastructure—serves as clear evidence that GDLockerSec lacks the advanced intrusion skills required to compromise such targets. This discrepancy between the group’s public posture and its operational reality underscores its status as a low-sophistication actor attempting to project greater credibility through fabricated claims.
Key points
- GDLockerSec posted claims of compromising lnrbda.gov.ng and aws.amazon.com on its dark web site within minutes of each other in January 2025.
- Forensic review determined that the data allegedly stolen from AWS originated from a public S3 bucket, indicating no actual security breach occurred.
- The group is linked to multiple Telegram aliases and previously operated under the name GhostSec-D, exhibiting poor operational security.
- Analysts characterize GDLockerSec as an amateur outfit that uses bold claims against high-value targets to attract attention and affiliates rather than demonstrating sophisticated intrusion capabilities.