LockBit Ransomware Group

Actor Type	Criminal Group

The LockBit Ransomware Group operate a 'Ransomware-as-a-Service' offering which first emerged around 2019. According to reports the first version of LockBit ransomware was released in 2019 and originally known as 'ABCD', subsequent versions include LockBit 2.0, LockBit 3.0 and LockBit Green. In 2022 the LockBit builder was leaked which spawned multiple other ransomware strains including 'Bl00dy', 'Darkrace' and 'Brain Spider'.

In February 2024, the group's operations were targeted in a disruption campaign named 'Operation Cronos' by the UK's National Cyber Security Agency, the FBI and international law enforcement partners.

The group has targeted thousands of victims and caused losses amounting to billions of dollars. Victims have been observed across multiple sectors including healthcare, education, government and manufacturing.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

LockBit Ransomware Group Threat Reports

Report

#StopRansomware: LockBit 3.0

This #StopRansomware Cybersecurity Advisory from CISA and partners describes the operations associated with LockBit 3.0 which operates as a ...

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.

Search:

ATT&CK ID	Title	Associated Tactics
T1021.001	Remote Desktop Protocol	Lateral Movement
T1027	Obfuscated Files or Information	Defense Evasion
T1078	Valid Accounts	Defense Evasion, Initial Access, Persistence, Privilege Escalation
T1003.001	LSASS Memory	Credential Access
T1486	Data Encrypted for Impact	Impact
T1070.004	File Deletion	Defense Evasion
T1490	Inhibit System Recovery	Impact
T1567.002	Exfiltration to Cloud Storage	Exfiltration
T1489	Service Stop	Impact
T1567	Exfiltration Over Web Service	Exfiltration
T1190	Exploit Public-Facing Application	Initial Access
T1614.001	System Language Discovery	Discovery
T1491.001	Internal Defacement	Impact
T1133	External Remote Services	Initial Access, Persistence
T1566	Phishing	Initial Access
T1072	Software Deployment Tools	Execution, Lateral Movement
T1547	Boot or Logon Autostart Execution	Persistence, Privilege Escalation
T1046	Network Service Discovery	Discovery
T1480.001	Environmental Keying	Defense Evasion
T1572	Protocol Tunneling	Command and Control
T1071.002	File Transfer Protocols	Command and Control
T1189	Drive-by Compromise	Initial Access
T1082	System Information Discovery	Discovery
T1485	Data Destruction	Impact

Showing 1 to 24 of 24 entries

LockBit Ransomware Group

Cyber Threat Graph Context

LockBit Ransomware Group Threat Reports

#StopRansomware: LockBit 3.0

References

www.cisa.gov

news.sky.com

unit42.paloaltonetworks.com

nationalcrimeagency.gov.uk

blog.talosintelligence.com

www.cisa.gov

MITRE ATT&CK Techniques