Lockbit
Overview
LockBit is arguably one of the most prolific and devastating Ransomware-as-a-Service (RaaS) operations in history. Targeting enterprises, critical infrastructure, and government entities worldwide, the LockBit cartel popularized the 'double extortion' tactic, where data is stolen before being encrypted.
What is LockBit?
Operating since 2019, the group has gone through several iterations, most notably LockBit 2.0 (Red) and LockBit 3.0 (Black). In early 2024, international law enforcement agencies (Operation Cronos) seized significant portions of LockBit's infrastructure, though affiliate groups continue to use leaked builders to launch attacks.
Infection Vectors & Threat Hunting
LockBit affiliates gain initial access via compromised RDP credentials, phishing, or exploiting unpatched vulnerabilities (e.g., in VPN appliances). Once inside, they move laterally using tools like Cobalt Strike and BloodHound. The ransomware itself is incredibly fast, utilizing multithreading and partial file encryption. Threat hunters must focus on the *pre-ransomware* behavior: look for unauthorized usage of PsExec, unexpected RDP sessions, and massive outbound data transfers to cloud storage (using tools like Rclone).
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
Observed techniques used by this family, mapped to the MITRE ATT&CK framework:
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_LOCKBIT {
meta:
description = "Detects Lockbit (ransomware)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "lockbit" ascii wide nocase
$s2 = "lockbit_3.0" ascii wide nocase
$s3 = "lockbit_black" ascii wide nocase
$s4 = "abcd_ransomware" ascii wide nocase
$s5 = "alphv" ascii wide nocase
$s6 = "blackcat" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Lockbit Activity
id: e409d35132ce99bfd44fe8c64c08c324
status: experimental
description: Detects generic indicators of the lockbit malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*lockbit*"
- "*lockbit_3.0*"
- "*lockbit_black*"
- "*abcd_ransomware*"
- "*alphv*"
- "*blackcat*"
condition: selection
level: mediumContainment & Response Steps
Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.
- Disconnect the affected network from the internet immediately to halt data exfiltration.
- Do NOT power off infected machines immediately, as memory analysis may yield decryption keys or crucial forensic artifacts.
What to Avoid
Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.
- Do not pay the ransom, as it does not guarantee data recovery and funds criminal enterprises.
References & External Analysis
- CISA Advisory
- Search "lockbit" on VirusTotal (External Analysis)
Authoritative Advisory
CISA has published an advisory on this family: AA23-075A
Frequently Asked Questions
Was LockBit taken down?
Yes, Operation Cronos severely disrupted LockBit in 2024, though isolated attacks using leaked builders still occur.
What is LockBit 3.0?
The third major iteration of the ransomware, also known as LockBit Black, which introduced a bug bounty program and enhanced anti-analysis features.
Related Families (Category: ransomware)
Explore other malware families in the same category:
Machine-readable
Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/lockbit.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Replit, StackBlitz, CodeSandbox, and CodePen.