Accounts with third-party service providers were used “for exfiltration or infrastructure,” according to a post by law enforcement on LockBit’s seized darkweb domain.
There’s typically reason to suspect the account owner first. They’re not trawling through random accounts, law enforcement doesn’t have the time or authority to do that. Note that intelligence agencies are not law enforcement, I’m not talking about what some spy agencies might do.
Since this is law enforcement, typically you don’t have a verdict to rely on, but they’d have a warrant or subpoena to get the necessary evidence to further the case.
There’s typically reason to suspect the account owner first. They’re not trawling through random accounts, law enforcement doesn’t have the time or authority to do that. Note that intelligence agencies are not law enforcement, I’m not talking about what some spy agencies might do.
Since this is law enforcement, typically you don’t have a verdict to rely on, but they’d have a warrant or subpoena to get the necessary evidence to further the case.