RansomwareFinancial gain

LockBit

Also known as: LockBit 2.0, LockBit 3.0, LockBit Black, ABCD (predecessor)

LockBit was the most deployed ransomware variant in the world in 2022, according to CISA. Its operators supplied the ransomware and leak site while affiliates broke into victims, so intrusions varied widely: exposed RDP, exploited vulnerabilities, phishing and stolen credentials. CISA counted about 1,700 US attacks and about $91 million in US ransoms paid.

Public attribution: A ransomware-as-a-service (RaaS) operation first seen on Russian-language cybercrime forums (CISA); MITRE ATT&CK tracks its ransomware as software rather than as a group.
Active since: Around 2019
Targets: Organisations of all sizes worldwide
Critical infrastructure, education, healthcare and government
Tracked by MITRE ATT&CK as software: S1199 LockBit 2.0 S1202 LockBit 3.0

Status: Infrastructure seized in Operation Cronos, February 2024 (UK NCA). Check current reporting before treating the operation as active or defunct.

Notable campaigns

2019-2020ABCD and early LockBit
ABCD ransomware, the predecessor, was first seen in September 2019; LockBit-named ransomware appeared in January 2020.
2022Most deployed variant
CISA and international partners reported LockBit as the most deployed ransomware variant globally.
2024Operation Cronos
The UK NCA-led operation took control of LockBit infrastructure in February 2024 and obtained over 1,000 decryption keys.

Signature ATT&CK techniques

Selected from MITRE ATT&CK's software entry and the cited government advisory.

Defences that work against this actor

Never expose RDP to the internet; put remote access behind a VPN or gateway with MFA.
Patch known exploited vulnerabilities in edge devices quickly.
Alert on Group Policy changes that deploy software or disable security tools.
Keep offline, tested backups and protect backup consoles with separate credentials.

Learn and practise on CyberCertPrep

Ransomware triage lab Glossary: ransomware Haxplain: privilege escalation

Sources

Notable campaigns

2019-2020ABCD and early LockBit

ABCD ransomware, the predecessor, was first seen in September 2019; LockBit-named ransomware appeared in January 2020.

2022Most deployed variant

CISA and international partners reported LockBit as the most deployed ransomware variant globally.

2024Operation Cronos

The UK NCA-led operation took control of LockBit infrastructure in February 2024 and obtained over 1,000 decryption keys.

Defences that work against this actor

Never expose RDP to the internet; put remote access behind a VPN or gateway with MFA.

Patch known exploited vulnerabilities in edge devices quickly.

Alert on Group Policy changes that deploy software or disable security tools.

Keep offline, tested backups and protect backup consoles with separate credentials.