Overview
LockBit is one of the most prolific ransomware groups in history, operating as a full RaaS platform that at its peak accounted for an estimated 44% of all ransomware incidents globally in 2023, targeting virtually every sector worldwide through an affiliate model where developers maintain infrastructure and affiliates conduct intrusions.
- First tracked: 2020-10-21
- Discussed in our reports: France · Gulf summary · Kuwait · Maghreb · Oman · Qatar · Türkiye
What public reporting says
Also known as: LockBit 3.0 (Black) · LockBit 5.0
- Disrupted by the UK-led Operation Cronos in February 2024. A Russian national alleged to be its lead operator was later indicted in the United States, sanctioned, and made the subject of a reward of up to USD 10 million. The brand returned as LockBit 5.0 in late 2025.
- LockBit 5.0 posted 163 victims in the first quarter of 2026, making it one of the most active operations globally again.
Geography: origin and targets
Assessed origin: Russian Federation. Russian-speaking operation; public indictments name Russian nationals as LockBit leaders and affiliates. Attribution is uncertain: read it as an assessment, not proof.
Thailand1
United Kingdom1
Switzerland1
India1
Exploited vulnerabilities
| Vendor | Product | CVE | Category | Source |
|---|---|---|---|---|
| Apache | Log4j | CVE-2021-44228 | Applications | cisa.gov, secureworks.com, blog.talosintelligence.com, trendmicro.com |
| Atlassian | Confluence Data Center & Server | CVE-2023-22527 | Applications | thedfirreport.com |
| Fortra | GoAnywhere Managed File Transfer | CVE-2023-0669 | File transfer servers | censys.io, cisa.gov |
| Windows | NetLogon | CVE-2020-1472 | Microsoft | cisa.gov, cisa.gov, cisa.gov, cisa.gov, cisa.gov, thedfirreport.com, thedfirreport.com, cisa.gov, cisa.gov, welivesecurity.com, cisa.gov, thedfirreport.com, checkpoint.com |
| Windows | Remote Desktop Services | CVE-2019-0708 | Microsoft | cisa.gov |
| Fortinet | FortiOS | CVE-2018-13379 | Network edge | tenable.com, cisa.gov, cisa.gov, trendmicro.com, cisa.gov |
| F5 | iControl REST | CVE-2021-22986 | Network edge | cisa.gov |
| Citrix | NetScaler ADC & Gateway | CVE-2023-4966 | Virtualization | doublepulsar.com, bleepingcomputer.com, therecord.media, secureworks.com, microsoft.com |
ATT&CK techniques
Columns are ATT&CK tactics; each cell is a technique reported for this group in public sources. A technique appearing here means it has been reported for the group, not that it was used in any particular incident, and an empty cell is not evidence that the group does not use it.
Technique details
Initial Access (TA0001)
- T1078 · Valid Accounts: Use of compromised credentials purchased from initial access brokers or obtained through phishing to authenticate to victim environments via RDP or VPN.
- T1190 · Exploit Public-Facing Application: LockBit actors exploit vulnerabilities in public-facing applications including Citrix Bleed (CVE-2023-4966), Fortinet, and other perimeter devices to gain initial access.
- T1566 · Phishing: Spear-phishing emails with malicious attachments or links used to deliver initial stagers.
Execution (TA0002)
- T1047 · Windows Management Instrumentation: WMI used for remote execution of payloads across compromised hosts.
- T1053.005 · Scheduled Task/Job: Scheduled Task: Scheduled tasks created for persistent execution of the LockBit payload and post-compromise tooling.
- T1059.001 · Command and Scripting Interpreter: PowerShell: PowerShell scripts used to deploy ransomware payloads and execute post-exploitation modules.
Persistence (TA0003)
- T1547.001 · Boot or Logon Autostart Execution: Registry Run Keys: Registry Run keys modified to ensure ransomware payload executes on system reboot.
Defense Evasion (TA0005)
- T1027 · Obfuscated Files or Information: LockBit payloads are packed and obfuscated; LockBit 3.0 (Black) uses code from BlackMatter ransomware with added anti-analysis techniques.
- T1070.001 · Indicator Removal: Clear Windows Event Logs: Event logs cleared to remove forensic evidence of the intrusion prior to or after ransomware deployment.
- T1562.001 · Disable or Modify Tools: Windows Defender and other AV/EDR tools disabled via PowerShell commands and Group Policy modifications prior to ransomware deployment.
Credential Access (TA0006)
- T1003.001 · OS Credential Dumping: LSASS Memory: Mimikatz and custom tools used to dump LSASS memory for credential harvesting to facilitate lateral movement.
- T1110 · Brute Force: Brute force attacks against RDP and other remote services to obtain valid credentials.
Discovery (TA0007)
- T1046 · Network Service Discovery: Network scanning tools (Advanced IP Scanner, nmap) used to enumerate hosts, open ports, and services within the victim environment.
- T1482 · Domain Trust Discovery: Active Directory enumeration to map domain trusts and identify targets for lateral movement and domain compromise.
Lateral Movement (TA0008)
- T1021.001 · Remote Services: Remote Desktop Protocol: RDP used extensively for lateral movement across the victim network using stolen credentials.
- T1021.002 · Remote Services: SMB/Windows Admin Shares: PsExec and SMB admin shares leveraged to propagate the ransomware payload laterally.
- T1210 · Exploitation of Remote Services: Exploitation of unpatched internal services to move laterally within the network.
Collection (TA0009)
- T1560.001 · Archive Collected Data: Archive via Utility: 7-Zip and WinRAR used to compress stolen data prior to exfiltration as part of double extortion operations.
Exfiltration (TA0010)
- T1048 · Exfiltration Over Alternative Protocol: SFTP and FTP used to transmit stolen data to actor-controlled infrastructure.
- T1567.002 · Exfiltration Over Web Service: Exfiltration to Cloud Storage: Rclone and MEGASync used to exfiltrate victim data to cloud storage services ahead of encryption as part of the double extortion model.
Command and Control (TA0011)
- T1090.003 · Proxy: Multi-hop Proxy: Tor and other anonymization networks used to obfuscate C2 infrastructure.
- T1219 · Remote Access Software: AnyDesk and other legitimate remote access tools deployed as backdoors for persistent C2 access.
Impact (TA0040)
- T1486 · Data Encrypted for Impact: LockBit uses AES-256 for file encryption with RSA-2048 for key protection. LockBit 3.0 uses Salsa20; files are appended with a victim-specific extension. Operates as RaaS with affiliate program.
- T1489 · Service Stop: Database, backup, and security services terminated before encryption to maximize file access and encryption coverage.
- T1490 · Inhibit System Recovery: Shadow copies and backups deleted using vssadmin and wmic commands to prevent recovery without paying the ransom.
Tools
None recorded in the sources we reviewed.
Leak-site infrastructure
| Title | Type | Address (defanged) | Seen online at snapshot |
|---|---|---|---|
| — | DLS | lockbitkodidilol[.]onion | No |
Sources and caveats
Group descriptions, ATT&CK mappings, tools and leak-site locations come from public ransomware tracking projects, including ransomware.live and Crocodyli. Exploited vulnerabilities come from the Ransomware-Vulnerability-Matrix by BushidoUK (licensed CC BY 4.0), supplemented where a group profile there is newer than the data we hold. Each CVE links to its original research source. Technical text is shown in English as published. Leak-site addresses are defanged and shown for blocking and detection; do not visit them. Nothing here is verified by ClairSec_ against a specific incident.
Data snapshot: 2026-10-11