LockBit
Also known as: LockBit 2.0, LockBit 3.0, LockBit Black, ABCD
LockBit was a ransomware-as-a-service operation that, according to the 2023 joint advisory by CISA and partner agencies, was the most deployed ransomware variant worldwide in 2022. Affiliates rented the malware and shared ransom payments with the developers, so intrusion methods varied widely. The operation was disrupted by the UK National Crime Agency-led Operation Cronos in February 2024.
- Public attribution and associated actors
- Run as ransomware-as-a-service; a 2023 joint advisory from CISA and international partners describes many unrelated affiliates using it.As publicly reported:LockBit (operators and affiliates)
- First seen
- Around 2019
- Platforms
- Windows, Linux, VMware ESXi
- MITRE ATT&CK software entries
- S1199 LockBit 2.0S1202 LockBit 3.0
Status: Infrastructure seized and disrupted in Operation Cronos in February 2024, led by the UK National Crime Agency with the FBI and Europol (reported).
How it spreads or gets in
- Affiliates gained access through exposed remote services such as RDP, exploitation of public-facing applications, phishing and purchased access (CISA AA23-165A).
- Pushed across domains using Group Policy and remote services once administrator access was obtained.
Key behaviours
- Stole data before encryption and threatened to publish it (double extortion).
- Bypassed User Account Control and modified Group Policy to spread.
- Deleted shadow copies and stopped services that would block encryption.
ATT&CK techniques
- T1133External Remote Services
- T1190Exploit Public-Facing Application
- T1484.001Domain or Tenant Policy Modification: Group Policy Modification
- T1548.002Abuse Elevation Control Mechanism: Bypass User Account Control
- T1021.002Remote Services: SMB/Windows Admin Shares
- T1486Data Encrypted for Impact
- T1490Inhibit System Recovery
- T1489Service Stop
Selected from the family's MITRE ATT&CK software entry, plus initial-access techniques named in the cited advisories.
Detection ideas
- Alert on new or changed Group Policy objects that launch executables or scheduled tasks.
- Watch for large outbound transfers to cloud storage or file-sharing services before an encryption event.
- Detect RDP logons from unusual sources and new remote-access tools.
Defences that work
- Put MFA on every remote access path and remove RDP from the internet.
- Patch internet-facing applications quickly, prioritising known exploited vulnerabilities.
- Restrict who can edit Group Policy and monitor those accounts closely.
- Keep offline, immutable backups and rehearse restores.