{
  "family": "lockbit",
  "sample_count": 3400,
  "category": "ransomware",
  "description": "LockBit is arguably one of the most prolific and devastating Ransomware-as-a-Service (RaaS) operations in history. Targeting enterprises, critical infrastructure, and government entities worldwide, the LockBit cartel popularized the 'double extortion' tactic, where data is stolen before being encrypted.<br><br><b>What is LockBit?</b><br>Operating since 2019, the group has gone through several iterations, most notably LockBit 2.0 (Red) and LockBit 3.0 (Black). In early 2024, international law enforcement agencies (Operation Cronos) seized significant portions of LockBit's infrastructure, though affiliate groups continue to use leaked builders to launch attacks.<br><br><b>Infection Vectors & Threat Hunting</b><br>LockBit affiliates gain initial access via compromised RDP credentials, phishing, or exploiting unpatched vulnerabilities (e.g., in VPN appliances). Once inside, they move laterally using tools like Cobalt Strike and BloodHound. The ransomware itself is incredibly fast, utilizing multithreading and partial file encryption. Threat hunters must focus on the *pre-ransomware* behavior: look for unauthorized usage of <code>PsExec</code>, unexpected RDP sessions, and massive outbound data transfers to cloud storage (using tools like Rclone).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "lockbit_3.0",
    "lockbit_black",
    "abcd_ransomware",
    "alphv",
    "blackcat"
  ],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "Was LockBit taken down?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, Operation Cronos severely disrupted LockBit in 2024, though isolated attacks using leaked builders still occur."
      }
    },
    {
      "@type": "Question",
      "name": "What is LockBit 3.0?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The third major iteration of the ransomware, also known as LockBit Black, which introduced a bug bounty program and enhanced anti-analysis features."
      }
    }
  ],
  "faq_count": 2,
  "mitre_attack": [
    "T1486",
    "T1078",
    "T1567.002",
    "T1047"
  ],
  "cisa_advisory": "AA23-075A",
  "last_updated": "2026-07-31",
  "mitre_attack_detail": [
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactic": "Impact"
    },
    {
      "id": "T1567.002",
      "name": "Exfiltration to Cloud Storage",
      "tactic": "Exfiltration"
    }
  ],
  "containment_steps": [
    "Disconnect the affected network from the internet immediately to halt data exfiltration.",
    "Do NOT power off infected machines immediately, as memory analysis may yield decryption keys or crucial forensic artifacts."
  ],
  "what_to_avoid": [
    "Do not pay the ransom, as it does not guarantee data recovery and funds criminal enterprises."
  ]
}