Home
LockBit Ransomware: MITRE ATT&CK coverage, attack chain, IOCs & detection guidance | ManageEngine

LockBit Ransomware

Ransomware-as-a-Service (RaaS) · First seen September 2019 · Last updated June 24, 2026

Overview

LockBit is a ransomware-as-a-service operation that has functioned as the dominant ransomware franchise globally since 2022. The group first appeared in September 2019 under the name ABCD, a reference to the .abcd extension appended to encrypted files. It evolved through successive major versions - LockBit 2.0 in 2021, LockBit 3.0 (LockBit Black) in 2022, LockBit 4.0 in February 2025, and LockBit 5.0 in September 2025 - each adding capability faster than defenders adapted. The core developers maintain the ransomware binary, affiliate panel, payment infrastructure, and data leak site. Affiliates pay for access to the platform, conduct their own intrusions, and keep up to 80% of any ransom collected.

CISA, the FBI, and 14 international partner agencies identified LockBit as the most globally active ransomware group in 2022 and 2023. In the United States alone, affiliates conducted approximately 1,700 attacks between January 2020 and May 2023, collecting around $91 million in ransom payments. At its peak, LockBit was responsible for an estimated 44% of all ransomware incidents globally.

In February 2024, Operation Cronos — a joint effort led by the UK's National Crime Agency and the FBI, involving 10 countries - seized 34 servers, closed 14,000 rogue accounts, froze 200 cryptocurrency accounts, and obtained over 1,000 decryption keys. Two suspects were arrested in Poland and Ukraine. The DOJ unsealed indictments against Russian nationals Artur Sungatov and Ivan Kondratyev (alias Bassterlord), and later identified and indicted Dmitry Yuryevich Khoroshev, operating as LockBitSupp, as the group's administrator. The group rebuilt within weeks and was advertising new victims within months.

LockBit 5.0, released September 2025, introduces cross-platform builds targeting Windows, Linux, and VMware ESXi, along with ETW patching to suppress telemetry, faster encryption using XChaCha20 and Curve25519, randomized 16-character file extensions, and a hardcoded kill list of 63 service name hashes that systematically terminates backup solutions, security tools, and database services before encryption begins. It remains active as of mid-2026.

Operational attack chain · LockBit affiliate intrusion to encryption
  1. Start

    Initial access

    RDP/VPN brute force · phishing · IAB-purchased access · public-facing app exploit

  2. Stage 1

    Foothold established

    Cobalt Strike or PowerShell Empire beacon deployed · persistence via registry / scheduled task

  3. Stage 2

    Credential dumping & discovery

    Mimikatz against LSASS · BloodHound AD enumeration · Advanced Port Scanner

  4. Stage 3

    Lateral movement

    SMB propagation · PsExec with stolen credentials · GPO-pushed payload deployment · RDP with harvested credentials

  5. Stage 4

    Data exfiltration

    StealBit · Rclone to cloud storage · MEGA upload · prior to encryption

  6. Stage 5

    Pre-encryption defense dismantling

    ETW patching · VSS deletion · service kill list (63 hashes) · log clearing · Safe Mode reboot in some variants

  7. Impact

    Encryption + double extortion

    Files encrypted across all reachable systems · ransom note dropped · leak site countdown begins

The attack chain above represents the most commonly observed affiliate playbook. Because LockBit operates as a RaaS, TTPs vary by affiliate. Some intrusions move from initial access to encryption in under 72 minutes. Others involve multi-week dwell periods with extensive data staging. The pre-encryption dismantling phase is consistent across all documented variants.

Tactics, techniques, and procedures

LockBit maps across the full MITRE ATT&CK Enterprise kill chain. The technique density is heaviest in Defense Evasion, Lateral Movement, and Impact. Because LockBit affiliates vary significantly, not all techniques appear in every intrusion, but the pre-encryption phase is consistent: service termination, shadow copy deletion, and log clearing occur in documented order before encryption runs.

MITRE ATT&CK coverageHeavyActiveNot observed
Recon0Resource Dev0Initial Access4Execution4Persistence3Priv. Esc2Defense Evasion6Credential Access3Discovery3Lateral3Collection2C22Exfiltration2Impact4
Technique detailKey techniques · LockBit Ransomware
TacticTechniquesWhat LockBit affiliates do
Initial Access
Exploit Public-Facing Application T1190Valid Accounts T1078External Remote Services T1133Phishing T1566
Affiliates most commonly exploit exposed RDP and VPN appliances, abuse valid credentials obtained from initial-access brokers or credential markets, or exploit vulnerabilities in public-facing applications. Phishing is used in a minority of intrusions. LockBit affiliates have exploited documented CVEs including CVE-2023-4966 (Citrix Bleed), CVE-2023-0669 (GoAnywhere MFT), and others in internet-facing services.
Execution
PowerShell T1059.001Windows Command Shell T1059.003Service Execution T1569.002Software Deployment Tools T1072
PowerShell and batch scripts are observed across most intrusions for discovery, credential hunting, and privilege escalation. The ransomware binary itself is typically executed via command line and accepts parameters to control encryption scope, Safe Mode rebooting, and lateral propagation. Some affiliates deploy payloads via Group Policy or PsExec service execution across the domain.
Persistence
Registry Run Keys T1547.001Scheduled Task T1053.005Windows Service T1543.003
Affiliates establish persistence through autostart registry keys, scheduled tasks, and new Windows services to maintain the post-exploitation foothold between C2 beacon cycles and across reboots. Persistence artifacts are often cleaned after the ransomware payload executes.
Privilege Escalation
Access Token Manipulation T1134UAC Bypass T1548.002
Affiliates escalate privileges using token impersonation after gaining a user-level foothold. LockBit 3.0 and later variants include UAC bypass routines. Reaching domain administrator rights is the typical goal, as domain admin credentials enable GPO-based ransomware deployment across all domain-joined systems simultaneously.
Defense Evasion
Disable/Modify Tools T1562.001Obfuscated Files T1027Clear Windows Event Logs T1070.001File Deletion T1070.004Environmental Keying T1480.001Sandbox Evasion T1497
LockBit 5.0 patches the EtwEventWrite API by overwriting its first instruction with a 0xC3 (return) opcode, disabling Windows Event Tracing at the kernel level before encryption begins. The payload clears all Windows event logs via EvtClearLog after encryption. Security services are terminated using a hardcoded kill list of 63 hashed service names including backup solutions, AV agents, and virtualization platform components. LockBit 3.0 requires a password at execution; without it, the binary cannot decrypt and execute itself, meaning each build generates a unique hash and signature-based detection fails. LockBit performs locale checks and terminates if Russian language settings or Russian geolocation are detected. Post-execution self-deletion uses file renaming with Alternative Data Streams (ADS) so the file disappears from directory listings while the process remains mapped.
Credential Access
LSASS Memory T1003.001Brute Force T1110Credentials from Stores T1555
Mimikatz is the primary credential dumping tool observed across LockBit affiliate intrusions, used to extract plaintext passwords, NTLM hashes, and Kerberos tickets from LSASS memory. LaZagne and ProcDump are also documented in affiliate toolsets. Brute force against exposed RDP and VPN services is frequently how affiliates establish initial access. Domain credentials recovered through LSASS dumping enable DCSync for AD replication and GPO-based deployment.
Discovery
Remote System Discovery T1018Domain Trust Discovery T1482Account Discovery T1087
Affiliates enumerate domain infrastructure using Advanced Port Scanner, AdFind, BloodHound, and network scanning scripts to map connected systems, locate domain controllers, and identify file servers and backup infrastructure. The goal is to understand the scope of the target environment before staging the payload for maximum encryption coverage.
Lateral Movement
Remote Desktop Protocol T1021.001SMB/Windows Admin Shares T1021.002Group Policy Modification T1484.001
LockBit self-propagates via SMB using credentials obtained earlier in the intrusion. Domain-joined environments allow affiliates to push customized Group Policy Objects that deploy the ransomware binary across all systems simultaneously, disable Windows Defender, and configure execution parameters. PsExec and Cobalt Strike are also used for interactive remote execution. RDP with harvested credentials provides direct interactive access to targeted systems.
Collection
Local System Data T1005Network Shared Drive Data T1039
Affiliates stage data for exfiltration before encryption runs. Target data typically includes financial records, customer databases, intellectual property, HR files, and legal documents — content with the highest leverage for the double extortion threat.
Command and Control
Web Protocols T1071.001Encrypted Channel T1573
Cobalt Strike beacons communicate over HTTPS using Malleable C2 profiles to blend with legitimate web traffic. LockBit 3.0 sends two encrypted HTTP POST requests to configured C2 servers with victim host information. FileZilla has been documented as a C2 mechanism by CISA in some affiliate deployments.
Exfiltration
Exfiltration to Cloud Storage T1567.002Exfiltration Over C2 T1041
StealBit is LockBit's proprietary exfiltration tool, introduced with LockBit 2.0 and seized by Operation Cronos in February 2024. Affiliates also use Rclone (an open-source cloud sync tool) and MEGA to transfer stolen data to cloud storage before triggering encryption. The NCA confirmed that Operation Cronos seized StealBit infrastructure across three countries.
Impact
Data Encrypted for Impact T1486Inhibit System Recovery T1490Service Stop T1489Defacement: Internal T1491.001
LockBit 5.0 encrypts files using XChaCha20 with Curve25519 key exchange, appending a randomized 16-character extension to each encrypted file. Volume Shadow Copies are deleted via COM interfaces (stealthier than VSSAdmin in prior versions). Services are terminated in sequence before encryption. The wallpaper and icons are changed to LockBit branding. A ransom note with a Tor-based negotiation link is dropped in every affected directory. ESXi variants target VM disk images directly, rendering entire virtualized workloads inaccessible from a single execution.
Reconnaissance / Resource Development—Not observed within victim environments. Pre-intrusion reconnaissance and infrastructure setup are handled before initial access or delegated to initial-access brokers who sell foothold access.
How the attack startsT1190 · T1078 · T1133 · T1110

Initial access: no single method

LockBit affiliates do not rely on a single delivery method. CISA documents initial access via RDP exploitation, drive-by compromise, phishing campaigns, abuse of valid accounts, and exploitation of public-facing applications. In practice, the most common path documented across incident reports is an exposed or weakly protected remote access service, an RDP port reachable from the internet, a VPN appliance running vulnerable software, or credentials obtained from an initial-access broker who acquired them through prior credential theft operations.

LockBit affiliates have exploited multiple documented CVEs in internet-facing appliances. CISA, the FBI, and partner agencies documented affiliates exploiting CVE-2023-4966 (Citrix Bleed) in Citrix NetScaler ADC and Gateway appliances, which allowed session token extraction and authentication bypass. Other exploited vulnerabilities in affiliate campaigns have included CVE-2023-0669 in GoAnywhere MFT and legacy CVEs in Fortinet VPN appliances.

A relevant behavioral signal for defenders: affiliates often test initial access before committing to an intrusion. The window between initial foothold and reconnaissance activity can be hours or days, and the window between reconnaissance and payload deployment can be further extended while data is staged for exfiltration. Defenders who detect the first-stage tools early - a Cobalt Strike beacon, Mimikatz execution, a BloodHound AD query, have a window to contain the intrusion before encryption runs.

What runs on the endpointT1059.001 · T1003.001 · T1484.001 · T1021.002

Tooling, credential access, and lateral spread

After establishing a foothold, affiliates deploy a standard post-exploitation toolkit. CISA documents approximately 30 freeware and open-source tools observed in LockBit affiliate intrusions, spanning network reconnaissance, remote access, credential dumping, and data exfiltration. The core cluster is consistent: Cobalt Strike or PowerShell Empire for C2, Mimikatz for credential extraction, Advanced Port Scanner or AdFind for network enumeration, and PsExec or GPO for lateral movement.

Credential dumping against LSASS is the pivotal step. Mimikatz extracts password hashes, then affiliates leverage those credentials to escalate to domain-level access. Once domain administrator privileges are obtained, affiliates can push a customized Group Policy Object to all domain-joined systems simultaneously, disabling Windows Defender, configuring the execution path of the ransomware binary, and delivering it to every endpoint in the organization in a single coordinated action. This is how LockBit achieves large-scale simultaneous encryption across hundreds or thousands of endpoints, not by running the binary on each one individually, but by abusing the trust infrastructure of the domain itself.

SMB propagation is a secondary mechanism. LockBit can self-spread via SMB connections using obtained credentials, targeting network shares and remote systems autonomously without additional attacker interaction. In environments with credential reuse across systems, this spreads the payload without needing GPO access.

How the malware evades detectionT1562.001 · T1070.001 · T1480.001 · T1027 · T1497

Pre-encryption defense dismantling

LockBit 5.0 runs a structured evasion and dismantling sequence before a single file is encrypted. Each step targets a specific detection or recovery mechanism.

ETW patching.The payload uses NtProtectVirtualMemory and NtWriteVirtualMemory to overwrite the first byte of EtwEventWrite with a 0xC3 return instruction. This disables Windows Event Tracing at the user-mode level, degrading the telemetry pipeline that many endpoint detection systems rely on. The patch takes effect before any encryption activity begins, meaning most of the encryption phase runs with reduced telemetry visibility.

Service kill list. The ransomware hashes the names of running services and compares them against a hardcoded list of 63 values. Any match is terminated. The list targets backup agents, AV engines, database services, and virtualization platform components, the specific services whose termination maximizes encryption coverage and eliminates the fastest recovery paths.

Volume Shadow Copy deletion. LockBit 5.0 deletes shadow copies via COM interfaces rather than the VSSAdmin command-line tool, which was a detection signal in prior versions. The COM-based approach is quieter and less likely to trigger process-based detection rules tuned for vssadmin.exe invocations.

Log clearing. The EvtClearLog API wipes all Windows event logs after encryption completes, removing the forensic record of what ran before and during the attack.

Environmental keying. LockBit 3.0 requires the correct password at execution time. Without it, the binary cannot decrypt and execute itself. This means each affiliate deployment generates a unique executable hash, and signature-based detection against static indicators fails for every new deployment. Locale and geolocation checks cause the binary to terminate on systems with Russian language settings.

Safe Mode execution. Some affiliate deployments reboot targeted systems into Safe Mode before running the ransomware, bypassing security software that does not load in Safe Mode. This is a configurable parameter in the LockBit execution arguments.

What it accesses and modifiesT1486 · T1490 · T1489 · T1567.002

Data exfiltration and encryption

Exfiltration runs before encryption. This sequencing is deliberate: if the target pays without encryption occurring, or if they restore from backups, the threat of data publication still generates extortion leverage. LockBit affiliates use StealBit, Rclone, and public file-sharing services including MEGA to exfiltrate staged data prior to deploying the encryption payload.

Once exfiltration completes and the pre-encryption kill sequence finishes, the ransomware payload runs. LockBit 5.0 uses XChaCha20 symmetric encryption with a Curve25519-based key exchange. The prior LockBit 3.0 variant used AES for file content and RSA for the key. Both use intermittent encryption — encrypting only the first portion of each file to maximize encryption speed rather than encrypting entire file contents. This is why encryption can complete across large file systems in minutes.

Each encrypted file receives a randomized 16-character extension. LockBit 5.0 removes infection markers that prior versions embedded at file endings, making recovery attempts and forensic analysis harder. A ransom note is written to every affected directory. The system wallpaper is replaced with LockBit branding.

For VMware ESXi targets, LockBit 5.0 has dedicated Linux and ESXi builds that encrypt VM disk images and datastores directly. A single execution against an ESXi host can render every virtual machine running on that host inaccessible simultaneously. The ESXi variants maintain the same command-line interface structure as the Windows build, allowing affiliates to operate across all platforms with consistent tooling.

It is documented that LockBit deleted stolen data even after some victims paid ransom, a significant factor in post-incident response planning. Ransom payment does not guarantee data deletion.

Process tree

What a LockBit affiliate intrusion looks like in EDR telemetry

How Malware Protection Plus responds

A walkthrough showing detection of the LockBit pre-encryption kill sequence, automated containment of the affected endpoint, and forensic capture of execution artifacts before log clearing completes.

Indicators of compromise

IOCs are separated into durable behavioral indicators, which persist across LockBit variants and affiliate rotations, and volatile indicators, which expire as infrastructure changes. Detection engineering should prioritize durable indicators.

File and path artifacts

Durable

Paths where LockBit affiliates stage tools, drop payloads, or leave persistence artifacts.

  • [random].README.txt (in every encrypted directory)LockBit 3.0 ransom note naming pattern — present in every affected folder
  • ReadMeForDecrypt.txt (LockBit 5.0 variant)LockBit 5.0 ransom note filename observed in 2025 campaigns
  • %TEMP%\rclone.exe or renamed rclone binaryExfiltration staging — Rclone dropped to temp or renamed to evade detection
  • C:\Windows\Temp\[affiliate tooling]Common staging path for Mimikatz, AdFind, and network scanners

Registry keys

Durable

Registry locations written during persistence establishment or pre-encryption GPO modification.

  • HKCU\...\CurrentVersion\Run (affiliate persistence)C2 beacon autostart — affiliate-configured
  • HKLM\...\TaskCache\Tasks (scheduled task persistence)Scheduled task created for ransomware payload execution
  • HKLM\SOFTWARE\Policies\Microsoft\Windows Defender (modified)GPO-pushed Defender disablement — monitor for unexpected writes
  • HKCR\.[random extension] (post-encryption file association)LockBit registers the encrypted extension for ransom note display

Process tree patterns

Durable

Execution sequences and parent-child chains that indicate an active LockBit affiliate intrusion.

  • svchost.exe → powershell.exe [-nop -w h -enc ...]Post-exploitation execution via RDP session context
  • Any process → mimikatz.exe sekurlsa::logonpasswordsLSASS credential dumping — universal LockBit affiliate signal
  • PsExec.exe → [payload].exe on remote systemsRemote execution phase prior to or during payload deployment
  • Any process → COM VSS delete (not vssadmin.exe)LockBit 5.0 uses COM-based VSS deletion — quieter than vssadmin
  • NtWriteVirtualMemory → EtwEventWrite overwrite (0xC3)ETW suppression — direct indicator of LockBit 5.0 execution

Network behavior

Durable / volatile mix

Outbound traffic patterns observable at firewall, proxy, or network detection layers.

  • Rclone connections to cloud storage (MEGA, S3-compatible)Data exfiltration prior to encryption — large outbound transfers
  • Cobalt Strike C2 beacon — HTTPS to non-categorized domainsRegular short-interval beaconing pattern with Malleable C2 profile
  • SMB lateral movement (445) from non-file-server endpointsEndpoint-to-endpoint SMB connections indicating worm-style propagation
  • Tor-based ransom negotiation URL (post-impact victim contact)Post-encryption artifact — present in ransom note

Detection guidance

LockBit affiliates use predominantly living-off-the-land tools and legitimate dual-use utilities. Signature detection against the ransomware binary fails by design, each build is password-encrypted at compile time, generating a unique hash. Behavioral detection is the viable path. The detection opportunities below are ordered by phase: the earlier in the attack chain a detection fires, the more recovery options remain.

  1. 01

    LSASS access from non-system processes

    Endpoint telemetry

    Monitor for processes opening a handle to lsass.exe with PROCESS_VM_READ access rights, or creating minidumps of LSASS memory (e.g., ProcDump, comsvcs.dll MiniDump, or renamed tools). Alert on sekurlsa, logonpasswords, or lsadump appearing in process command arguments.

    Why it works: LSASS dumping is the pivot that converts a low-privilege foothold into domain-level lateral movement. Detecting it stops the intrusion before the ransomware payload is ever staged.

  2. 02

    Domain enumeration tooling

    Endpoint / AD telemetry

    Alert on execution of AdFind.exe, BloodHound's SharpHound collector, or Advanced Port Scanner from workstations or servers where these tools have no legitimate administrative function. Monitor LDAP queries that enumerate all computers, all users, or domain trust relationships in rapid succession from a single source.

    Why it works: affiliates cannot proceed to domain-wide GPO deployment or targeted server encryption without first mapping the environment. Enumeration is a reliable early-phase signal.

  3. 03

    Cobalt Strike beacon patterns

    Network / EDR telemetry

    Monitor for regular short-interval HTTPS POST requests (typically every 60 seconds) to newly registered or low-reputation domains. Alert on processes performing network connections that have no prior network history for that binary — common when Cobalt Strike beacons are injected into trusted system processes. DNS queries to domains registered within the last 30 days from non-browser processes warrant investigation.

    Why it works: Cobalt Strike is the dominant post-exploitation framework across LockBit affiliate intrusions. Detecting the beacon is earlier in the chain than detecting the ransomware execution.

  4. 04

    Anomalous SMB and lateral movement activity

    Network / EDR telemetry

    Alert on SMB connections originating from workstations to a large number of internal hosts in a short time window. Monitor for PsExec service installation events (PSEXESVC appearing in Windows services) on remote systems when initiated outside a change window. Flag net use commands mapping to domain controller admin shares (\\[DC]\IPC$) from non-admin workstations.

    Why it works: lateral movement at scale is how LockBit affiliates prepare for simultaneous domain-wide encryption. Detecting the spread at the network layer catches the intrusion before encryption executes.

  5. 05

    Large outbound data transfers via Rclone or MEGA

    Network / DLP telemetry

    Alert on rclone.exe execution or processes with Rclone network signatures transferring to cloud storage endpoints. Flag large outbound HTTPS transfers (hundreds of megabytes or gigabytes) to cloud storage services from file servers or database servers. Alert on MEGA domain connections from servers that do not typically access cloud sync services.

    Why it works: exfiltration precedes encryption. Detecting data staging or upload activity gives a window to stop the intrusion before files are locked. This detection fires even in intrusions where affiliates opt for data-theft-only extortion without encryption.

  6. 06

    Pre-encryption kill sequence

    EDR / service telemetry

    Monitor for rapid sequential termination of backup agents, AV services, and database services within a short window — particularly when initiated by an unusual parent process rather than a legitimate management platform. Alert on EvtClearLog API calls or batch event log clearing via wevtutil.exe cl. Monitor for COM-based VSS snapshot deletion from non-backup processes. Alert on writes to EtwEventWrite function memory from any user-mode process.

    Why it works: this sequence runs immediately before encryption. Detecting it even slightly before encryption completes enables endpoint isolation that limits the scope of files locked.

  7. 07

    Mass file rename and extension change

    Endpoint / filesystem telemetry

    Alert on a single process renaming or modifying hundreds of files per second across multiple directories. Flag creation of ransom note files with patterns like *.README.txt or ReadMeForDecrypt.txt appearing simultaneously across directory trees. Monitor for wallpaper registry key changes combined with mass file rename activity.

    Why it works: encryption has started, but many endpoints may still be unaffected. Rapid detection here enables network isolation to limit spread via SMB propagation to additional hosts. This is the last detection gate before full impact.

Hardening recommendations

The controls below address the specific access paths and techniques LockBit affiliates depend on most consistently. Items are tagged by deployment effort. Quick win = configurable within days via GPO or policy change. Standard = needs audit-mode rollout or phased deployment across systems. Strategic = architectural change requiring planning.

  1. Restrict RDP exposure and enforce Network Level Authentication

    Quick win

    RDP is the most common initial access path in documented LockBit affiliate intrusions. Restrict RDP to internal networks or VPN-gated access only. Enable Network Level Authentication. Monitor for and block RDP brute force patterns at the firewall or authentication layer.

    Path: Computer Configuration → Administrative Templates → Windows Components → Remote Desktop Services → Require NLA. Supplement with firewall rules blocking external port 3389.

  2. Deploy phishing-resistant MFA for all remote access and privileged accounts

    Quick win

    Valid credential abuse is a primary LockBit access method. TOTP-based MFA is increasingly bypassed through adversary-in-the-middle and session hijacking techniques observed in affiliate tradecraft. FIDO2 or passkey-based authentication is resistant to these bypass methods.

    Priority accounts: domain administrators, VPN accounts, remote desktop users, and all accounts with access to backup infrastructure or domain controllers.

  3. Enable Credential Guard and Protected Users security group

    Standard

    Windows Credential Guard isolates LSASS in a Hyper-V protected virtual process (VTL1), preventing Mimikatz from accessing credential material from the user-mode LSASS process. The Protected Users security group enforces stronger credential protections including disabling NTLM authentication and Kerberos delegation for members.

    Path: Device Guard / Credential Guard policy under Computer Configuration → Administrative Templates → System → Device Guard. Test in audit mode before enforcing — applications relying on legacy NTLM may be affected.

  4. Implement tiered administration and restrict GPO modification rights

    Standard

    Domain-wide GPO deployment of ransomware is possible only when an affiliate holds domain admin credentials. Tiered administration separates domain admin accounts from everyday workstation management accounts, limits the blast radius of credential compromise, and reduces the account types that can modify Group Policy Objects linked to domain-wide OUs.

    Path: Implement Active Directory tiering (Tier 0 for domain controllers, Tier 1 for servers, Tier 2 for workstations). Audit GPO modification permissions and alert on GPO changes outside change control windows.

  5. Maintain immutable, network-isolated backup copies and test restoration regularly

    Quick win

    Volume Shadow Copies are deleted by every documented LockBit variant. Backup infrastructure accessible from domain-joined systems is targeted during lateral movement. Backups that are air-gapped or use immutable storage are the recovery path that does not require ransom negotiation. Test restoration from backup on a defined cadence — the discovery that backups are incomplete typically happens during an incident, not before.

    Path: Isolate backup management servers from domain-joined systems. Use dedicated backup accounts not present in Active Directory. Configure immutable storage or WORM (write once, read many) policies on backup targets.

  6. Patch internet-facing services aggressively, targeting perimeter appliances first

    Quick win

    LockBit affiliates have exploited vulnerabilities in Citrix NetScaler (CVE-2023-4966), GoAnywhere MFT (CVE-2023-0669), and Fortinet VPN appliances documented by CISA. Perimeter appliances — VPN concentrators, application delivery controllers, and remote access gateways — are the highest-priority patch targets because exploitation yields direct access without requiring phishing victim cooperation.

    Path: Automate patching for internet-facing systems. Track CVEs against currently deployed versions of perimeter appliances. Subscribe to vendor security advisories for all edge devices.

  7. Segment VMware ESXi management networks

    Strategic

    LockBit 5.0's ESXi variant encrypts VM disk images directly, taking down every virtual machine on a compromised host with a single execution. vCenter and ESXi management interfaces should be isolated on networks inaccessible from domain-joined workstations. Require MFA on vCenter authentication. Restrict which accounts have the ability to run commands directly on ESXi hosts.

    Path: Place ESXi management interfaces on a dedicated VLAN with no route from the enterprise AD network. Apply firewall rules permitting ESXi management access only from specific jump hosts with privileged access controls.

Response recommendations

The steps below apply to confirmed or suspected LockBit affiliate intrusions. Sequencing matters: containment must precede remediation, and forensic preservation must precede cleanup.

  1. 01

    Isolate affected endpoints immediately

    Network-isolate all endpoints with confirmed encryption or ransomware process activity. Disable network interfaces — not just disconnect from domain — to prevent SMB propagation to additional hosts. For ESXi, isolate the hypervisor management network from domain systems before attempting any remediation.

  2. 02

    Preserve forensic artifacts before log clearing completes

    LockBit 5.0 clears all Windows event logs post-encryption. If isolation occurs before encryption is complete, capture Windows event logs, PowerShell script block logs, Prefetch, Shimcache, Amcache, and registry hives from affected systems immediately. Memory acquisition from systems still running is valuable — the Cobalt Strike beacon and credential material may still be in memory.

  3. 03

    Identify patient zero and map the intrusion timeline

    Determine the initial access point: which RDP account was brute-forced, which VPN appliance was exploited, or which credentials were purchased. The intrusion timeline drives recovery prioritization — systems first accessed but not yet encrypted may still be containable. Review authentication logs on domain controllers for anomalous account activity from the estimated initial access date.

  4. 04

    Disable compromised accounts and reset domain credentials

    Disable or reset all accounts that the attacker demonstrably used or could have accessed via Mimikatz during the intrusion. Rotate the KRBTGT account password twice (the standard practice to invalidate Kerberos golden tickets). Force password resets across administrative and service accounts. Do not reuse compromised systems for administrative access during the active response.

  5. 05

    Assess exfiltration scope and prepare for double extortion

    Review network flow data and proxy logs for large outbound transfers to cloud storage services during the intrusion window. Identify what data may have been staged and exfiltrated — this determines downstream legal notification obligations and the scope of the double extortion threat. Note that paying ransom does not guarantee data deletion; the NCA confirmed that LockBit deleted data for some paid victims anyway.

  6. 06

    Restore from validated, isolated backups

    Restore from backup copies that were network-isolated from the compromised environment during the intrusion period. Validate backup integrity before restoring to production. Rebuild affected systems from clean images where possible rather than attempting in-place cleanup. Check whether the DOJ / FBI LockBit victims portal has decryption keys available for your variant if paying ransom is under consideration.

  7. 07

    Hunt for persistence across the environment before returning to production

    Hunt for scheduled tasks, autostart registry keys, new Windows services, and GPO modifications introduced during the intrusion period. Affiliates frequently maintain persistence through Cobalt Strike beacons even after the ransomware executes, allowing re-entry if cleanup is incomplete. Do not reconnect restored systems to production networks until the persistence hunt is complete.

Where Malware Protection Plus fits

The LockBit kill chain creates distinct behavioral detection opportunities before, during, and at the point of encryption. Malware Protection Plus helps security teams act on those opportunities rather than discovering an incident from a ransom note.

Malware Protection Plus helps security teams detect the behavioral patterns that define a LockBit affiliate intrusion, independent of binary hash or known C2 domains. On the credential access side, it can identify LSASS access from non-system processes — the Mimikatz step that converts a low-privilege RDP foothold into domain admin credentials. On the lateral movement side, it monitors for anomalous SMB patterns and PsExec service installations that indicate staging across the domain before encryption runs.

The pre-encryption sequence — service termination in rapid succession, VSS deletion, ETW patching, log clearing — is a high-confidence indicator of active LockBit execution. Malware Protection Plus can identify these behaviors through endpoint telemetry and support automated endpoint isolation to stop propagation to additional hosts. Even when ETW telemetry is degraded by the EtwEventWrite patch, filesystem-layer monitoring for mass file rename events, ransom note creation, and wallpaper modification provides a final detection signal.

For post-incident response, Malware Protection Plus supports root cause investigation across affected endpoints, helps identify the initial access entry point and lateral movement path, and enables remediation and endpoint restoration. The goal is to reduce the window between intrusion and containment — not after files are locked, but earlier in the chain while more recovery options remain open.

Primary references

Source material this page is built on. Last reviewed against CISA, FBI, NCA, and DOJ reporting through April 2026. LockBit 5.0 technical analysis reviewed through sample reports published September 2025.

Test your defenses against LockBit kill chains before encryption

Malware Protection Plus helps security teams detect credential dumping, lateral movement, service disruption, and mass file changes that signal a LockBit intrusion.

Start free trial →