Presunta extorsión de LockBit 3.0 contra el Banco de Venezuela con archivos posteriormente reportados

What this source supports

• El Diario reported that LockBit listed Banco de Venezuela on 19 April 2023 with a 10 May deadline
• the report reproduced screenshots of the actor listing and the bank statement
• the bank stated that its public platform and electronic channels were operating normally

Evidence limits

Contemporaneous media report based on the actor listing, security researchers and the victim statement; it does not independently establish intrusion, encryption or exfiltration.

Relevance to this case

Corroborates the public claim, deadline and official response while preserving their conflicting scope.

What this source supports

• Efecto Cocuyo reported the LockBit listing and 10 May deadline
• the article displayed alleged sample files including an identity card, invoices and payment relations
• the article quoted the bank statement that public channels were normal
• the article explicitly said the total scope was uncertain

Evidence limits

The article and embedded researchers infer internal encryption from actor-site material; no victim telemetry or independently authenticated files are provided.

Relevance to this case

Useful contemporaneous account of the claim and alleged samples, but not proof that malware executed or that the samples originated from the bank.

What this source supports

• Escudo Digital reported that LockBit added Banco de Venezuela to its leak site
• the report reproduced the bank statement that its systems were functioning normally
• the report retained hypothetical language about possible publication

Evidence limits

Secondary report dependent on the same actor claim and official response; no technical evidence or authenticated samples.

Relevance to this case

Independent publication corroborating the existence and public framing of the claim, not the underlying compromise.

What this source supports

• El Estímulo reported on 13 July that files attributed to the Banco de Venezuela claim had been published
• the report described apparent identity cards, RIF documents and insurance applications
• Asilo Digital estimated approximately 7,000 files
• the article reproduced the bank public-channel statement

Evidence limits

The article relies on security-account observations and screenshots. It provides no independently authenticated corpus, chain of custody or forensic proof linking the apparent documents to a compromise of the bank.

Relevance to this case

Best accessible narrative for the later publication report and alleged document categories, with material limitations.

What this source supports

• Azpúrua reported that the LockBit page named Banco de Venezuela
• he stated that the scope was unknown and the public website worked
• the attached images show an actor listing with a 10 May deadline and apparent document samples

Evidence limits

Security-researcher observation of an actor page; images do not authenticate the underlying documents or prove compromise, encryption or exfiltration.

Relevance to this case

Direct accessible provenance for the public actor listing and explicit uncertainty.

What this source supports

• VE sin Filtro reported that the actor blog claimed Banco de Venezuela
• the post said the actor claimed internal data were encrypted and threatened publication in 20 days
• the image shows the actor listing and 10 May deadline

Evidence limits

The claims of encryption and internal access are researcher repetition of actor material, not independently verified findings.

Relevance to this case

Corroborates the public claim and deadline while remaining claim-level evidence.

What this source supports

• the main post provides general LockBit ransomware context
• the visible reply says account x00x01x01 appeared to claim access to the bank network and showed alleged user listings

Evidence limits

Neither the separate account claim nor its screenshot was authenticated or technically linked to LockBit or the April listing.

Relevance to this case

Preserves a distinct contemporaneous claim without merging it into confirmed incident facts.

What this source supports

• Banco de Venezuela stated that its platform and electronic channels were operating normally with integrity and security

Evidence limits

The statement addresses public platform and channel operation but does not expressly confirm or deny internal-system access or alleged exfiltration.

Relevance to this case

Direct victim-side statement establishing no documented public-channel disruption at that time.

What this source supports

• VenariX reported that LockBit added Banco de Venezuela back to its blog and published files
• one image shows the actor page marked files are published
• one image shows a blurred file listing
• one image reproduces the bank statement

Evidence limits

Security-account observation and screenshots are primary only for the public claim. The file list is blurred and no corpus, hash, chain of custody or authentication was provided.

Relevance to this case

Best exact accessible provenance for the July actor-page publication claim, not proof of genuine bank data.

What this source supports

• the visible post says confidential Banco de Venezuela data were leaked
• the visible text recalls the earlier LockBit claim and payment deadline

Evidence limits

The visible card and graphic provide no authenticated files or technical validation; the approximately 7,000 estimate is preserved through El Estímulo rather than asserted from the truncated card.

Relevance to this case

Corroborates public reporting of a leak while retaining the card and evidence limitations.