# LockBit Ransomware

Ransomware-as-a-Service (RaaS) · First seen September 2019 · Last updated June 24, 2026

## Overview

LockBit is a ransomware-as-a-service operation that has functioned as the dominant ransomware franchise globally since 2022. The group first appeared in September 2019 under the name ABCD, a reference to the `.abcd` extension appended to encrypted files. It evolved through successive major versions - LockBit 2.0 in 2021, LockBit 3.0 (LockBit Black) in 2022, LockBit 4.0 in February 2025, and [LockBit 5.0 in September 2025](https://www.infosecurity-magazine.com/news/lockbit-ransomware-most-dangerous/) - each adding capability faster than defenders adapted. The core developers maintain the ransomware binary, affiliate panel, payment infrastructure, and data leak site. Affiliates pay for access to the platform, conduct their own intrusions, and keep up to 80% of any ransom collected.

[CISA, the FBI, and 14 international partner agencies identified LockBit as the most globally active ransomware group in 2022 and 2023.](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a) In the United States alone, affiliates conducted approximately 1,700 attacks between January 2020 and May 2023, collecting around $91 million in ransom payments. At its peak, LockBit was responsible for an estimated 44% of all ransomware incidents globally.

In February 2024, [Operation Cronos — a joint effort led by the UK's National Crime Agency and the FBI, involving 10 countries](https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group) - seized 34 servers, closed 14,000 rogue accounts, froze 200 cryptocurrency accounts, and obtained over 1,000 decryption keys. Two suspects were arrested in Poland and Ukraine. The DOJ unsealed indictments against Russian nationals Artur Sungatov and Ivan Kondratyev (alias Bassterlord), and later identified and indicted Dmitry Yuryevich Khoroshev, operating as LockBitSupp, as the group's administrator. The group rebuilt within weeks and was advertising new victims within months.

LockBit 5.0, released September 2025, [introduces cross-platform builds targeting Windows, Linux, and VMware ESXi](https://gbhackers.com/lockbit-5-0-ransomware/), along with ETW patching to suppress telemetry, faster encryption using XChaCha20 and Curve25519, randomized 16-character file extensions, and a hardcoded kill list of 63 service name hashes that systematically terminates backup solutions, security tools, and database services before encryption begins. It remains active as of mid-2026.

### Threat profile

**Updated:** June 24, 2026

| Field | Value |
|---|---|
| Type | Ransomware (RaaS) |
| First seen | Sep 2019 |
| Administrator | LockBitSupp (indicted) |
| Status | Active · LockBit 5.0 |
| Aliases | ABCD, LockBit 2.0, LockBit Black (3.0), ChuongDong (5.0) |
| Current variant | LockBit 5.0 (Sep 2025) |
| Extortion model | Double extortion · encrypt + leak threat |
| Target platforms | Windows · Linux · VMware ESXi |
| Primary sectors | Manufacturing · healthcare · financial services · government · legal |
| Initial access vectors | RDP/VPN exploitation · phishing · valid accounts · public-facing app exploits · IAB-purchased access |
| Key tools | Cobalt Strike · Mimikatz · PsExec · StealBit · Rclone · GMER · Advanced Port Scanner |
| Encryption | XChaCha20 + Curve25519 (v5.0) · AES + RSA (v3.0) |
| Law enforcement action | Operation Cronos · Feb 2024 · NCA / FBI / Europol |

## Operational attack chain

1. **Initial access**  
   RDP/VPN brute force · phishing · IAB-purchased access · public-facing app exploit

2. **Foothold established**  
   Cobalt Strike or PowerShell Empire beacon deployed · persistence via registry / scheduled task

3. **Credential dumping & discovery**  
   Mimikatz against LSASS · BloodHound AD enumeration · Advanced Port Scanner

4. **Lateral movement**  
   SMB propagation · PsExec with stolen credentials · GPO-pushed payload deployment · RDP with harvested credentials

5. **Data exfiltration**  
   StealBit · Rclone to cloud storage · MEGA upload · prior to encryption

6. **Pre-encryption defense dismantling**  
   ETW patching · VSS deletion · service kill list (63 hashes) · log clearing · Safe Mode reboot in some variants

7. **Impact: Encryption + double extortion**  
   Files encrypted across all reachable systems · ransom note dropped · leak site countdown begins

The attack chain above represents the most commonly observed affiliate playbook. Because LockBit operates as a RaaS, TTPs vary by affiliate. Some intrusions move from initial access to encryption in under 72 minutes. Others involve multi-week dwell periods with extensive data staging. The pre-encryption dismantling phase is consistent across all documented variants.

## Tactics, techniques, and procedures

LockBit maps across the full MITRE ATT&CK Enterprise kill chain. The technique density is heaviest in Defense Evasion, Lateral Movement, and Impact. Because LockBit affiliates vary significantly, not all techniques appear in every intrusion, but the pre-encryption phase is consistent: service termination, shadow copy deletion, and log clearing occur in documented order before encryption runs.

### MITRE ATT&CK coverage

| Tactic | Technique Count |
|---|---|
| Reconnaissance | 0 |
| Resource Development | 0 |
| Initial Access | 4 |
| Execution | 4 |
| Persistence | 3 |
| Privilege Escalation | 2 |
| Defense Evasion | 6 |
| Credential Access | 3 |
| Discovery | 3 |
| Lateral Movement | 3 |
| Collection | 2 |
| Command and Control | 2 |
| Exfiltration | 2 |
| Impact | 4 |

### Technique detail

| Tactic | Techniques | What LockBit affiliates do |
|---|---|---|
| Initial Access | [Exploit Public-Facing Application (T1190)](https://attack.mitre.org/techniques/T1190/) · [Valid Accounts (T1078)](https://attack.mitre.org/techniques/T1078/) · [External Remote Services (T1133)](https://attack.mitre.org/techniques/T1133/) · [Phishing (T1566)](https://attack.mitre.org/techniques/T1566/) | Affiliates most commonly exploit exposed RDP and VPN appliances, abuse valid credentials obtained from initial-access brokers or credential markets, or exploit vulnerabilities in public-facing applications. Phishing is used in a minority of intrusions. LockBit affiliates have exploited documented CVEs including CVE-2023-4966 (Citrix Bleed), CVE-2023-0669 (GoAnywhere MFT), and others in internet-facing services. |
| Execution | [PowerShell (T1059.001)](https://attack.mitre.org/techniques/T1059/001/) · [Windows Command Shell (T1059.003)](https://attack.mitre.org/techniques/T1059/003/) · [Service Execution (T1569.002)](https://attack.mitre.org/techniques/T1569/002/) · [Software Deployment Tools (T1072)](https://attack.mitre.org/techniques/T1072/) | PowerShell and batch scripts are observed across most intrusions for discovery, credential hunting, and privilege escalation. The ransomware binary itself is typically executed via command line and accepts parameters to control encryption scope, Safe Mode rebooting, and lateral propagation. Some affiliates deploy payloads via Group Policy or PsExec service execution across the domain. |
| Persistence | [Registry Run Keys (T1547.001)](https://attack.mitre.org/techniques/T1547/001/) · [Scheduled Task (T1053.005)](https://attack.mitre.org/techniques/T1053/005/) · [Windows Service (T1543.003)](https://attack.mitre.org/techniques/T1543/003/) | Affiliates establish persistence through autostart registry keys, scheduled tasks, and new Windows services to maintain the post-exploitation foothold between C2 beacon cycles and across reboots. Persistence artifacts are often cleaned after the ransomware payload executes. |
| Privilege Escalation | [Access Token Manipulation (T1134)](https://attack.mitre.org/techniques/T1134/) · [UAC Bypass (T1548.002)](https://attack.mitre.org/techniques/T1548/002/) | Affiliates escalate privileges using token impersonation after gaining a user-level foothold. LockBit 3.0 and later variants include UAC bypass routines. Reaching domain administrator rights is the typical goal, as domain admin credentials enable GPO-based ransomware deployment across all domain-joined systems simultaneously. |
| Defense Evasion | [Disable/Modify Tools (T1562.001)](https://attack.mitre.org/techniques/T1562/001/) · [Obfuscated Files (T1027)](https://attack.mitre.org/techniques/T1027/) · [Clear Windows Event Logs (T1070.001)](https://attack.mitre.org/techniques/T1070/001/) · [File Deletion (T1070.004)](https://attack.mitre.org/techniques/T1070/004/) · [Environmental Keying (T1480.001)](https://attack.mitre.org/techniques/T1480/001/) · [Sandbox Evasion (T1497)](https://attack.mitre.org/techniques/T1497/) | LockBit 5.0 patches the `EtwEventWrite` API by overwriting its first instruction with a `0xC3` (return) opcode, disabling Windows Event Tracing before encryption begins. The payload clears all Windows event logs via `EvtClearLog` after encryption. Security services are terminated using a hardcoded kill list of 63 hashed service names. LockBit 3.0 requires a password at execution, meaning each build generates a unique hash and [signature-based detection](https://www.manageengine.com/malware-protection/articles/signature-based-detection.html) fails. Locale checks terminate execution on Russian systems. |
| Credential Access | [LSASS Memory (T1003.001)](https://attack.mitre.org/techniques/T1003/001/) · [Brute Force (T1110)](https://attack.mitre.org/techniques/T1110/) · [Credentials from Stores (T1555)](https://attack.mitre.org/techniques/T1555/) | Mimikatz is the primary credential dumping tool observed across LockBit affiliate intrusions. Brute force against exposed RDP and VPN services is frequently how affiliates establish initial access. Domain credentials recovered enable DCSync for AD replication and GPO-based deployment. |
| Discovery | [Remote System Discovery (T1018)](https://attack.mitre.org/techniques/T1018/) · [Domain Trust Discovery (T1482)](https://attack.mitre.org/techniques/T1482/) · [Account Discovery (T1087)](https://attack.mitre.org/techniques/T1087/) | Affiliates enumerate domain infrastructure using Advanced Port Scanner, AdFind, BloodHound, and network scanning scripts to map connected systems and identify file servers and backup infrastructure. |
| Lateral Movement | [Remote Desktop Protocol (T1021.001)](https://attack.mitre.org/techniques/T1021/001/) · [SMB/Windows Admin Shares (T1021.002)](https://attack.mitre.org/techniques/T1021/002/) · [Group Policy Modification (T1484.001)](https://attack.mitre.org/techniques/T1484/001/) | LockBit self-propagates via SMB using credentials obtained earlier. Affiliates push customized GPOs to deploy the ransomware binary across all systems simultaneously and disable Windows Defender. PsExec and Cobalt Strike are also used for interactive remote execution. |
| Collection | [Local System Data (T1005)](https://attack.mitre.org/techniques/T1005/) · [Network Shared Drive Data (T1039)](https://attack.mitre.org/techniques/T1039/) | Affiliates stage high-value data (financial records, IP, HR, legal files) for exfiltration before encryption runs. |
| Command and Control | [Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/) · [Encrypted Channel (T1573)](https://attack.mitre.org/techniques/T1573/) | Cobalt Strike beacons communicate over HTTPS using Malleable C2 profiles to blend with legitimate traffic. |
| Exfiltration | [Exfiltration to Cloud Storage (T1567.002)](https://attack.mitre.org/techniques/T1567/002/) · [Exfiltration Over C2 (T1041)](https://attack.mitre.org/techniques/T1041/) | StealBit, Rclone, and MEGA are used to transfer stolen data before triggering encryption. |
| Impact | [Data Encrypted for Impact (T1486)](https://attack.mitre.org/techniques/T1486/) · [Inhibit System Recovery (T1490)](https://attack.mitre.org/techniques/T1490/) · [Service Stop (T1489)](https://attack.mitre.org/techniques/T1489/) · [Defacement: Internal (T1491.001)](https://attack.mitre.org/techniques/T1491/001/) | LockBit 5.0 encrypts files using XChaCha20 with Curve25519 key exchange, appending randomized extensions. Volume Shadow Copies are deleted via COM interfaces. A ransom note with a Tor-based negotiation link is dropped in every affected directory. ESXi variants target VM disk images directly. |

## Indicators of compromise

IOCs are separated into durable behavioral indicators and volatile indicators that expire as infrastructure changes. Detection engineering should prioritize durable indicators.

### File and path artifacts (Durable)

- `[random].README.txt` (in every encrypted directory)  
  LockBit 3.0 ransom note naming pattern.

- `ReadMeForDecrypt.txt` (LockBit 5.0 variant)  
  Observed in 2025 campaigns.

- `%TEMP%\rclone.exe` or renamed rclone binary  
  Exfiltration staging.

- `C:\Windows\Temp\[affiliate tooling]`  
  Common staging path for Mimikatz, AdFind, and scanners.

### Registry keys (Durable)

- `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`  
  C2 beacon autostart.

- `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks`  
  Scheduled task persistence.

- `HKLM\SOFTWARE\Policies\Microsoft\Windows Defender`  
  Monitor for unexpected writes (GPO-pushed Defender disablement).

- `HKCR\.[random extension]`  
  Post-encryption file association.

### Process tree patterns (Durable)

- `svchost.exe → powershell.exe -nop -w h -enc ...`  
  Post-exploitation via RDP session context.

- `mimikatz.exe sekurlsa::logonpasswords`  
  LSASS credential dumping.

- `PsExec.exe → [payload].exe` on remote systems  
  Lateral movement phase.

- COM-based VSS deletion (not `vssadmin.exe`)  
  LockBit 5.0 shadow copy deletion.

- `NtWriteVirtualMemory → EtwEventWrite overwrite (0xC3)`  
  ETW suppression indicator.

### Network behavior (Durable / Volatile mix)

- Rclone connections to cloud storage (MEGA, S3-compatible)  
  Large outbound transfers before encryption.

- Cobalt Strike HTTPS beacon to low-reputation domains  
  Short-interval POST requests.

- SMB (445) lateral movement from non-file-server endpoints  
  Endpoint-to-endpoint propagation.

- Tor-based ransom negotiation URL  
  Post-impact artifact in ransom note.

## Detection guidance

LockBit affiliates use predominantly [living-off-the-land](https://www.manageengine.com/malware-protection/articles/living-off-the-land-attack.html) tools and legitimate dual-use utilities. Signature detection fails by design. Behavioral detection is required.

1. **LSASS access from non-system processes**  
   Monitor for processes opening handles to `lsass.exe` with `PROCESS_VM_READ`, or creating LSASS minidumps. Detect `sekurlsa` or `logonpasswords` in command arguments.  
   **Why it works:** Stops escalation before domain-wide deployment.

2. **Domain enumeration tooling**  
   Alert on `AdFind.exe`, BloodHound (`SharpHound`), or `Advanced Port Scanner` from non-admin systems. Monitor rapid LDAP enumeration queries.  
   **Why it works:** Enumeration precedes GPO-based ransomware deployment.

3. **Cobalt Strike beacon patterns**  
   Detect regular HTTPS POST beaconing to new or low-reputation domains. Flag network connections from unusual parent processes.  
   **Why it works:** Beacon detection occurs earlier than ransomware execution.

4. **Anomalous SMB and lateral movement**  
   Alert on large numbers of SMB connections from workstations. Monitor `PSEXESVC` service creation events.  
   **Why it works:** Catches spread before encryption triggers.

5. **Large outbound data transfers via Rclone or MEGA**  
   Detect `rclone.exe` execution and large outbound HTTPS uploads.  
   **Why it works:** Exfiltration precedes encryption.

6. **Pre-encryption kill sequence**  
   Monitor rapid service termination, `EvtClearLog` usage, COM-based VSS deletion, and writes to `EtwEventWrite`.  
   **Why it works:** Immediately precedes encryption.

7. **Mass file rename and extension change**  
   Alert on hundreds of file modifications per second and ransom note creation patterns.  
   **Why it works:** Final detection gate before full impact.

## Hardening recommendations

1. **Restrict RDP exposure and enforce Network Level Authentication** (Quick win)  
   Limit RDP to internal or VPN-only access. Enable NLA. Block external port 3389.

2. **Deploy phishing-resistant MFA for remote and privileged accounts** (Quick win)  
   Use FIDO2 or passkeys for domain admins, VPN users, and backup administrators.

3. **Enable Credential Guard and Protected Users group** (Standard)  
   Isolate LSASS and restrict NTLM/Kerberos delegation.

4. **Implement tiered administration and restrict GPO modification rights** (Standard)  
   Separate Tier 0/1/2 accounts and audit GPO changes.

5. **Maintain immutable, network-isolated backups** (Quick win)  
   Use air-gapped or WORM storage. Test restoration regularly.

6. **Patch internet-facing services aggressively** (Quick win)  
   Prioritize perimeter appliances such as Citrix NetScaler (CVE-2023-4966) and GoAnywhere MFT (CVE-2023-0669).

7. **Segment VMware ESXi management networks** (Strategic)  
   Isolate ESXi/vCenter management from domain networks and require MFA.

No single control eliminates LockBit risk. Layered prevention, detection, and response capability is required.

## Response recommendations

1. **Isolate affected endpoints immediately**  
   Disable network interfaces to prevent SMB propagation. Isolate ESXi management networks before remediation.

2. **Preserve forensic artifacts**  
   Capture event logs, PowerShell logs, registry hives, Prefetch, Shimcache, Amcache, and memory before log clearing completes.

3. **Identify patient zero and map timeline**  
   Determine initial access method and review authentication logs.

4. **Disable compromised accounts and reset credentials**  
   Rotate KRBTGT twice. Reset administrative and service accounts.

5. **Assess exfiltration scope**  
   Review network logs for large outbound transfers and prepare for double extortion implications.

6. **Restore from validated, isolated backups**  
   Rebuild from clean images where possible. Check DOJ/FBI victim portals for available decryption keys.

7. **Hunt for persistence before returning to production**  
   Review scheduled tasks, services, registry keys, and GPO changes introduced during the intrusion.

## Primary references

- [CISA, FBI, and 14 international partners — Understanding Ransomware Threat Actors: LockBit (AA23-165A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a) — Jun 2023  
- [FBI, CISA, and MS-ISAC — #StopRansomware: LockBit 3.0 (AA23-075A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a) — Mar 2023  
- [CISA, FBI, MS-ISAC, ACSC — LockBit 3.0 Affiliates Exploit CVE-2023-4966 Citrix Bleed (AA23-325A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a) — Nov 2023  
- [National Crime Agency — Operation Cronos: NCA leads international investigation targeting LockBit](https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group) — Feb 2024  
- [LevelBlue SpiderLabs — 19 Shades of LockBit 5.0: Windows sample technical analysis](https://www.levelblue.com/blogs/spiderlabs-blog/19-shades-of-lockbit-5.0-inside-the-latest-cross-platform-ransomware-part-3) — Feb 2026  
- [Academic analysis — Inside LockBit: Technical, Behavioral, and Financial Anatomy of a Ransomware Empire (arXiv, 2025)](https://arxiv.org/html/2511.06429v1) — Nov 2025  
- [MITRE ATT&CK — LockBit software entry and Enterprise framework reference](https://attack.mitre.org/software/S0365/) — Current