# LockBit Ransomware

Ransomware-as-a-Service (RaaS) · First seen September 2019 · Last updated June 24, 2026

## Overview

LockBit is a ransomware-as-a-service operation that has functioned as the dominant ransomware franchise globally since 2022. The group first appeared in September 2019 under the name ABCD, a reference to the `.abcd` extension appended to encrypted files. It evolved through successive major versions - LockBit 2.0 in 2021, LockBit 3.0 (LockBit Black) in 2022, LockBit 4.0 in February 2025, and [LockBit 5.0 in September 2025](https://www.infosecurity-magazine.com/news/lockbit-ransomware-most-dangerous/) - each adding capability faster than defenders adapted. The core developers maintain the ransomware binary, affiliate panel, payment infrastructure, and data leak site. Affiliates pay for access to the platform, conduct their own intrusions, and keep up to 80% of any ransom collected.

[CISA, the FBI, and 14 international partner agencies identified LockBit as the most globally active ransomware group in 2022 and 2023.](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a) In the United States alone, affiliates conducted approximately 1,700 attacks between January 2020 and May 2023, collecting around $91 million in ransom payments. At its peak, LockBit was responsible for an estimated 44% of all ransomware incidents globally.

In February 2024, [Operation Cronos — a joint effort led by the UK's National Crime Agency and the FBI, involving 10 countries](https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group) - seized 34 servers, closed 14,000 rogue accounts, froze 200 cryptocurrency accounts, and obtained over 1,000 decryption keys. Two suspects were arrested in Poland and Ukraine. The DOJ unsealed indictments against Russian nationals Artur Sungatov and Ivan Kondratyev (alias Bassterlord), and later identified and indicted Dmitry Yuryevich Khoroshev, operating as LockBitSupp, as the group's administrator. The group rebuilt within weeks and was advertising new victims within months.

LockBit 5.0, released September 2025, [introduces cross-platform builds targeting Windows, Linux, and VMware ESXi](https://gbhackers.com/lockbit-5-0-ransomware/), along with ETW patching to suppress telemetry, faster encryption using XChaCha20 and Curve25519, randomized 16-character file extensions, and a hardcoded kill list of 63 service name hashes that systematically terminates backup solutions, security tools, and database services before encryption begins. It remains active as of mid-2026.

### Threat profile

**Updated June 24, 2026**

| Field | Value |
|---|---|
| Type | Ransomware (RaaS) |
| First seen | Sep 2019 |
| Administrator | LockBitSupp (indicted) |
| Status | Active · LockBit 5.0 |
| Aliases | ABCD, LockBit 2.0, LockBit Black (3.0), ChuongDong (5.0) |
| Current variant | LockBit 5.0 (Sep 2025) |
| Extortion model | Double extortion · encrypt + leak threat |
| Target platforms | Windows · Linux · VMware ESXi |
| Primary sectors | Manufacturing · healthcare · financial services · government · legal |
| Initial access vectors | RDP/VPN exploitation · phishing · valid accounts · public-facing app exploits · IAB-purchased access |
| Key tools | Cobalt Strike · Mimikatz · PsExec · StealBit · Rclone · GMER · Advanced Port Scanner |
| Encryption | XChaCha20 + Curve25519 (v5.0) · AES + RSA (v3.0) |
| Law enforcement action | Operation Cronos · Feb 2024 · NCA / FBI / Europol |

## Operational attack chain

### LockBit affiliate intrusion to encryption

1. **Initial access**  
   RDP/VPN brute force · phishing · IAB-purchased access · public-facing app exploit

2. **Foothold established**  
   Cobalt Strike or PowerShell Empire beacon deployed · persistence via registry / scheduled task

3. **Credential dumping & discovery**  
   Mimikatz against LSASS · BloodHound AD enumeration · Advanced Port Scanner

4. **Lateral movement**  
   SMB propagation · PsExec with stolen credentials · GPO-pushed payload deployment · RDP with harvested credentials

5. **Data exfiltration**  
   StealBit · Rclone to cloud storage · MEGA upload · prior to encryption

6. **Pre-encryption defense dismantling**  
   ETW patching · VSS deletion · service kill list (63 hashes) · log clearing · Safe Mode reboot in some variants

7. **Impact: Encryption + double extortion**  
   Files encrypted across all reachable systems · ransom note dropped · leak site countdown begins

The attack chain above represents the most commonly observed affiliate playbook. Because LockBit operates as a RaaS, TTPs vary by affiliate. Some intrusions move from initial access to encryption in under 72 minutes. Others involve multi-week dwell periods with extensive data staging. The pre-encryption dismantling phase is consistent across all documented variants.

## Tactics, techniques, and procedures

LockBit maps across the full MITRE ATT&CK Enterprise kill chain. The technique density is heaviest in Defense Evasion, Lateral Movement, and Impact. Because LockBit affiliates vary significantly, not all techniques appear in every intrusion, but the pre-encryption phase is consistent: service termination, shadow copy deletion, and log clearing occur in documented order before encryption runs.

### MITRE ATT&CK coverage

| Tactic | Techniques | What LockBit affiliates do |
|---|---|---|
| Initial Access | [Exploit Public-Facing Application (T1190)](https://attack.mitre.org/techniques/T1190/) · [Valid Accounts (T1078)](https://attack.mitre.org/techniques/T1078/) · [External Remote Services (T1133)](https://attack.mitre.org/techniques/T1133/) · [Phishing (T1566)](https://attack.mitre.org/techniques/T1566/) | Affiliates most commonly exploit exposed RDP and VPN appliances, abuse valid credentials obtained from initial-access brokers or credential markets, or exploit vulnerabilities in public-facing applications. Phishing is used in a minority of intrusions. LockBit affiliates have exploited documented CVEs including CVE-2023-4966 (Citrix Bleed), CVE-2023-0669 (GoAnywhere MFT), and others in internet-facing services. |
| Execution | [PowerShell (T1059.001)](https://attack.mitre.org/techniques/T1059/001/) · [Windows Command Shell (T1059.003)](https://attack.mitre.org/techniques/T1059/003/) · [Service Execution (T1569.002)](https://attack.mitre.org/techniques/T1569/002/) · [Software Deployment Tools (T1072)](https://attack.mitre.org/techniques/T1072/) | PowerShell and batch scripts are observed across most intrusions for discovery, credential hunting, and privilege escalation. The ransomware binary itself is typically executed via command line and accepts parameters to control encryption scope, Safe Mode rebooting, and lateral propagation. Some affiliates deploy payloads via Group Policy or PsExec service execution across the domain. |
| Persistence | [Registry Run Keys (T1547.001)](https://attack.mitre.org/techniques/T1547/001/) · [Scheduled Task (T1053.005)](https://attack.mitre.org/techniques/T1053/005/) · [Windows Service (T1543.003)](https://attack.mitre.org/techniques/T1543/003/) | Affiliates establish persistence through autostart registry keys, scheduled tasks, and new Windows services to maintain the post-exploitation foothold between C2 beacon cycles and across reboots. Persistence artifacts are often cleaned after the ransomware payload executes. |
| Privilege Escalation | [Access Token Manipulation (T1134)](https://attack.mitre.org/techniques/T1134/) · [UAC Bypass (T1548.002)](https://attack.mitre.org/techniques/T1548/002/) | Affiliates escalate privileges using token impersonation after gaining a user-level foothold. LockBit 3.0 and later variants include UAC bypass routines. Reaching domain administrator rights is the typical goal, as domain admin credentials enable GPO-based ransomware deployment across all domain-joined systems simultaneously. |
| Defense Evasion | [Disable/Modify Tools (T1562.001)](https://attack.mitre.org/techniques/T1562/001/) · [Obfuscated Files (T1027)](https://attack.mitre.org/techniques/T1027/) · [Clear Windows Event Logs (T1070.001)](https://attack.mitre.org/techniques/T1070/001/) · [File Deletion (T1070.004)](https://attack.mitre.org/techniques/T1070/004/) · [Environmental Keying (T1480.001)](https://attack.mitre.org/techniques/T1480/001/) · [Sandbox Evasion (T1497)](https://attack.mitre.org/techniques/T1497/) | LockBit 5.0 patches the `EtwEventWrite` API by overwriting its first instruction with a `0xC3` (return) opcode, disabling Windows Event Tracing at the kernel level before encryption begins. The payload clears all Windows event logs via `EvtClearLog` after encryption. Security services are terminated using a hardcoded kill list of 63 hashed service names including backup solutions, AV agents, and virtualization platform components. LockBit 3.0 requires a password at execution; without it, the binary cannot decrypt and execute itself, meaning each build generates a unique hash and [signature-based detection](https://www.manageengine.com/malware-protection/articles/signature-based-detection.html) fails. LockBit performs locale checks and terminates if Russian language settings or Russian geolocation are detected. Post-execution self-deletion uses file renaming with Alternative Data Streams (ADS). |
| Credential Access | [LSASS Memory (T1003.001)](https://attack.mitre.org/techniques/T1003/001/) · [Brute Force (T1110)](https://attack.mitre.org/techniques/T1110/) · [Credentials from Stores (T1555)](https://attack.mitre.org/techniques/T1555/) | Mimikatz is the primary credential dumping tool observed across LockBit affiliate intrusions, used to extract plaintext passwords, NTLM hashes, and Kerberos tickets from LSASS memory. LaZagne and ProcDump are also documented in affiliate toolsets. Brute force against exposed RDP and VPN services is frequently how affiliates establish initial access. |
| Discovery | [Remote System Discovery (T1018)](https://attack.mitre.org/techniques/T1018/) · [Domain Trust Discovery (T1482)](https://attack.mitre.org/techniques/T1482/) · [Account Discovery (T1087)](https://attack.mitre.org/techniques/T1087/) | Affiliates enumerate domain infrastructure using Advanced Port Scanner, AdFind, BloodHound, and network scanning scripts to map connected systems, locate domain controllers, and identify file servers and backup infrastructure. |
| Lateral Movement | [Remote Desktop Protocol (T1021.001)](https://attack.mitre.org/techniques/T1021/001/) · [SMB/Windows Admin Shares (T1021.002)](https://attack.mitre.org/techniques/T1021/002/) · [Group Policy Modification (T1484.001)](https://attack.mitre.org/techniques/T1484/001/) | LockBit self-propagates via SMB using credentials obtained earlier in the intrusion. Domain-joined environments allow affiliates to push customized Group Policy Objects that deploy the ransomware binary across all systems simultaneously. PsExec and Cobalt Strike are also used for interactive remote execution. |
| Collection | [Local System Data (T1005)](https://attack.mitre.org/techniques/T1005/) · [Network Shared Drive Data (T1039)](https://attack.mitre.org/techniques/T1039/) | Affiliates stage data for exfiltration before encryption runs, targeting financial records, customer databases, intellectual property, HR files, and legal documents. |
| Command and Control | [Web Protocols (T1071.001)](https://attack.mitre.org/techniques/T1071/001/) · [Encrypted Channel (T1573)](https://attack.mitre.org/techniques/T1573/) | Cobalt Strike beacons communicate over HTTPS using Malleable C2 profiles to blend with legitimate web traffic. LockBit 3.0 sends two encrypted HTTP POST requests to configured C2 servers with victim host information. |
| Exfiltration | [Exfiltration to Cloud Storage (T1567.002)](https://attack.mitre.org/techniques/T1567/002/) · [Exfiltration Over C2 (T1041)](https://attack.mitre.org/techniques/T1041/) | StealBit is LockBit's proprietary exfiltration tool. Affiliates also use Rclone and MEGA to transfer stolen data to cloud storage before triggering encryption. |
| Impact | [Data Encrypted for Impact (T1486)](https://attack.mitre.org/techniques/T1486/) · [Inhibit System Recovery (T1490)](https://attack.mitre.org/techniques/T1490/) · [Service Stop (T1489)](https://attack.mitre.org/techniques/T1489/) · [Defacement: Internal (T1491.001)](https://attack.mitre.org/techniques/T1491/001/) | LockBit 5.0 encrypts files using XChaCha20 with Curve25519 key exchange, appending a randomized 16-character extension. Volume Shadow Copies are deleted via COM interfaces. Services are terminated in sequence before encryption. A ransom note with a Tor-based negotiation link is dropped in every affected directory. ESXi variants target VM disk images directly. |

### Initial access: no single method

LockBit affiliates do not rely on a single delivery method. [CISA documents initial access via RDP exploitation, drive-by compromise, phishing campaigns, abuse of valid accounts, and exploitation of public-facing applications.](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a)

Affiliates have exploited CVE-2023-4966 (Citrix Bleed) and CVE-2023-0669 (GoAnywhere MFT), among others in internet-facing services.

### Tooling, credential access, and lateral spread

After establishing a foothold, affiliates deploy a standard post-exploitation toolkit. [CISA documents approximately 30 freeware and open-source tools observed in LockBit affiliate intrusions.](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a)

[Mimikatz extracts password hashes, then affiliates leverage those credentials to escalate to domain-level access.](https://en.wikipedia.org/wiki/LockBit)

### Pre-encryption defense dismantling

LockBit 5.0 runs a structured [evasion](https://www.manageengine.com/malware-protection/articles/malware-evasion-technique.html) and dismantling sequence before encryption.

- **ETW patching** via `NtProtectVirtualMemory` and `NtWriteVirtualMemory`
- **Service kill list** targeting 63 hashed service names
- **Volume Shadow Copy deletion** via COM interfaces
- **Log clearing** using `EvtClearLog`
- **Environmental keying** and locale checks
- **Safe Mode execution** in some deployments

### Data exfiltration and encryption

[LockBit affiliates use StealBit, Rclone, and MEGA to exfiltrate data prior to encryption.](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a)

LockBit 5.0 uses XChaCha20 symmetric encryption with Curve25519-based key exchange. [LockBit 5.0 has dedicated Linux and ESXi builds that encrypt VM disk images and datastores directly.](https://www.infosecurity-magazine.com/news/lockbit-ransomware-most-dangerous/)

## Process tree

### What a LockBit affiliate intrusion looks like in EDR telemetry

```
svchost.exe [PID 1204]   // or rdpclip.exe — RDP session context
└─ powershell.exe [PID 3412] -nop -w h -enc [base64]
   └─ cmd.exe [PID 4188] net use \\[DC] /user:[domain]\[admin] [pw]
   └─ mimikatz.exe [PID 4312] sekurlsa::logonpasswords
   └─ AdFind.exe [PID 4519] -f "(objectcategory=computer)"

rclone.exe [PID 5201] copy [staging path] remote:[bucket]

lockbit.exe [PID 6044] -pass [key] -path C:\ -network
   └─ NtWriteVirtualMemory → patches EtwEventWrite (0xC3)
   └─ COM: IVssBackupComponents → deletes all VSS shadow copies
   └─ EvtClearLog → all Windows event channels wiped
   └─ File encryption loop → XChaCha20 · [random].ext appended
```

## Indicators of compromise

IOCs are separated into durable behavioral indicators and volatile indicators. Detection engineering should prioritize durable indicators.

### File and path artifacts (Durable)

- `[random].README.txt` (in every encrypted directory)  
- `ReadMeForDecrypt.txt` (LockBit 5.0 variant)  
- `%TEMP%\rclone.exe` or renamed rclone binary  
- `C:\Windows\Temp\[affiliate tooling]`

### Registry keys (Durable)

- `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`
- `HKLM\Software\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks`
- `HKLM\SOFTWARE\Policies\Microsoft\Windows Defender`
- `HKCR\.[random extension]`

### Process tree patterns (Durable)

- `svchost.exe → powershell.exe [-nop -w h -enc ...]`
- `mimikatz.exe sekurlsa::logonpasswords`
- `PsExec.exe → [payload].exe on remote systems`
- COM-based VSS deletion (not `vssadmin.exe`)
- `NtWriteVirtualMemory → EtwEventWrite overwrite (0xC3)`

### Network behavior (Durable / volatile mix)

- Rclone connections to cloud storage (MEGA, S3-compatible)
- Cobalt Strike HTTPS beaconing to low-reputation domains
- SMB lateral movement (port 445) from non-file-server endpoints
- Tor-based ransom negotiation URLs

## Detection guidance

LockBit affiliates use predominantly [living-off-the-land](https://www.manageengine.com/malware-protection/articles/living-off-the-land-attack.html) tools and legitimate dual-use utilities. Signature detection against the ransomware binary fails by design. Behavioral detection is required.

1. **LSASS access from non-system processes**  
   Monitor for processes opening handles to `lsass.exe` with `PROCESS_VM_READ`.

2. **Domain enumeration tooling**  
   Alert on execution of `AdFind.exe`, `SharpHound`, or `Advanced Port Scanner`.

3. **Cobalt Strike beacon patterns**  
   Monitor for regular short-interval HTTPS POST requests to newly registered domains.

4. **Anomalous SMB and lateral movement activity**  
   Alert on PsExec service installation events and unusual `net use` commands.

5. **Large outbound data transfers via Rclone or MEGA**  
   Flag large outbound HTTPS transfers from servers.

6. **Pre-encryption kill sequence**  
   Monitor for rapid service termination, COM-based VSS deletion, `EvtClearLog`, and writes to `EtwEventWrite`.

7. **Mass file rename and extension change**  
   Alert on a single process renaming hundreds of files per second and simultaneous ransom note creation.

## Hardening recommendations

1. **Restrict RDP exposure and enforce Network Level Authentication** (Quick win)

2. **Deploy phishing-resistant MFA for remote access and privileged accounts** (Quick win)

3. **Enable Credential Guard and Protected Users security group** (Standard)

4. **Implement tiered administration and restrict GPO modification rights** (Standard)

5. **Maintain immutable, network-isolated backup copies and test restoration regularly** (Quick win)

6. **Patch internet-facing services aggressively** (Quick win)

7. **Segment VMware ESXi management networks** (Strategic)

Controls 1–2 reduce initial access success. Controls 3–4 limit credential escalation and domain-wide GPO deployment. Control 5 preserves recovery options. Control 6 closes the perimeter appliance exploitation path. Control 7 contains the ESXi blast radius.

## Response recommendations

1. **Isolate affected endpoints immediately**  
   Disable network interfaces to prevent SMB propagation.

2. **Preserve forensic artifacts before log clearing completes**  
   Capture Windows event logs, PowerShell logs, registry hives, and memory.

3. **Identify patient zero and map the intrusion timeline**

4. **Disable compromised accounts and reset domain credentials**  
   Rotate KRBTGT password twice and reset administrative accounts.

5. **Assess exfiltration scope and prepare for double extortion**

6. **Restore from validated, isolated backups**  
   Consider checking the DOJ / FBI victims portal for available decryption keys.

7. **Hunt for persistence before returning to production**

## Primary references

- [CISA, FBI, and 14 international partners — Understanding Ransomware Threat Actors: LockBit (AA23-165A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a) — Jun 2023  
- [FBI, CISA, and MS-ISAC — #StopRansomware: LockBit 3.0 (AA23-075A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a) — Mar 2023  
- [CISA, FBI, MS-ISAC, ACSC — LockBit 3.0 Affiliates Exploit CVE-2023-4966 Citrix Bleed (AA23-325A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a) — Nov 2023  
- [National Crime Agency — Operation Cronos: NCA leads international investigation targeting LockBit](https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group) — Feb 2024  
- [LevelBlue SpiderLabs — 19 Shades of LockBit 5.0: Windows sample technical analysis](https://www.levelblue.com/blogs/spiderlabs-blog/19-shades-of-lockbit-5.0-inside-the-latest-cross-platform-ransomware-part-3) — Feb 2026  
- [Academic analysis — Inside LockBit: Technical, Behavioral, and Financial Anatomy of a Ransomware Empire (arXiv, 2025)](https://arxiv.org/html/2511.06429v1) — Nov 2025  
- [MITRE ATT&CK — LockBit software entry and Enterprise framework reference](https://attack.mitre.org/software/S0365/) — Current