LockBit

Techniques and tactics

LockBit operators frequently gain initial access by exploiting vulnerable Remote Desktop Protocol (RDP) servers or compromised credentials purchased from affiliates. Initial access vectors also include phishing emails with malicious attachments or links, brute-forcing weak RDP or VPN passwords, and exploiting vulnerabilities such as CVE-2018-13379 in Fortinet VPNs.^[1]

Once installed, LockBit ransomware is often executed in Microsoft Windows via command-line arguments, scheduled tasks, or PowerShell scripts such as PowerShell Empire. LockBit uses tools such as Mimikatz, GMER, Process Hacker, and registry edits to gather credentials, disable security products, and evade defenses. It enumerates network connections to identify high-value targets such as domain controllers using scanners such as Advanced Port Scanner.^[1]

For lateral movement, LockBit spreads through SMB file-sharing connections inside networks, using credentials gathered earlier. Other lateral movement techniques include distributing itself via compromised Group Policy objects, or using tools such as PsExec or Cobalt Strike.^[1]

LockBit's ransomware payload encrypts files and network shares using AES and RSA encryption. It encrypts only the first few kilobytes of each file for faster processing, and adds a ".lockbit" extension. LockBit then replaces the desktop wallpaper with a ransom note; it can also print ransom notes to attached printers. The goal is to extort payment of a ransom to reverse system disruption and restore file access.^[1]

LockBit 2.0

LockBit 2.0 appeared in 2021^[19] and came into the spotlight with their attack on Accenture the same year, where an insider probably helped the group entering the network. LockBit published some of the data stolen in this attack.^[20][1]

In January 2022, the electronics company Thales was one of the victims of Lockbit 2.0.^[21]

In July 2022, the administrative and management services of La Poste Mobile were attacked.^[22]

In September 2022, the group's hackers claimed cyberattacks against 28 organizations, 12 of which involved French organizations.^[23] Among them, the Corbeil Essonnes hospital was targeted with a ransom demand of US$10 million.^[24]

In October 2022, the LockBit group claimed responsibility for an attack on Pendragon PLC, a group of automotive retailers in the UK, demanding a ransom of US$60 million to decrypt the files and not leak them; the company stated that they refused the demand.^[25]

On October 31, 2022, the LockBit hacker group claimed to have attacked Thales Group for the second time and did not demand a ransom, but said that the data would be released. The hacker group offered assistance to Thales customers affected by the theft, in order to lodge a complaint against Thales, a group "that has greatly disregarded confidentiality rules".^[26] On November 10, 2022, the LockBit 3.0 group published on the darknet a 9.5 GB archive with stolen information on Thales contracts in Italy and Malaysia.^[27][28]

In November 2022, OEHC - Office d'Équipement Hydraulique de Corse - was the victim of a cyberattack that encrypted the company's computer data. A ransom demand was made by the hacker group, to which OEHC did not respond.^[29]

In December 2022, the LockBit hacker group claimed responsibility for the attack on the California Finance Administration. The governor's office acknowledged being the victim of an attack, without specifying its scale. Lockbit claims to have stolen 246,000 files with a total size of 75.3 GB.^[30]

In December 2022, the hacker group claimed to have attacked the port of Lisbon. The ransom was set at US$1.5 million, to be paid by January 18, 2023.^[31]

On December 18, 2022, a group of hackers attacked Toronto's Hospital for Sick Children. After realizing their blunder, the hacker group stopped the attack, apologized and offered a free solution to recover the encrypted files.^[32] In a subsequent interview, LockBit members stated they have a policy against attacking hospitals.^[33]

LockBit 3.0

In late June 2022, the group launched "LockBit 3.0", the latest variant of their ransomware, after two months of beta testing. Notably, the group introduced a bug bounty program, the first of its kind in the realm of ransomware operations. They invited security researchers to test their software to improve their security, offering substantial monetary rewards ranging from US$1,000 to $1 million.^[1]

In August 2022, German equipment manufacturer Continental suffered a LockBit ransomware attack. In November 2022, with no response to its ransom demand, the hacker group published part of the stolen data and offered access to all of it for 50 million euros. Among the stolen data are the private lives of the Group's employees, as well as exchanges with German car manufacturers. Beyond the theft of data, the danger lies in opening the way to industrial espionage. Indeed, among the exchanges with Volkswagen are IT aspects, from automated driving to entertainment, in which Volkswagen wanted Continental to invest.^[34]

In November 2022, the United States Department of Justice announced the arrest of Mikhail Vasiliev, a dual Russian and Canadian national, in connection with the LockBit ransomware campaign. According to the charges, Vasiliev allegedly conspired with others involved in LockBit, a ransomware variant that had been used in over 1,000 attacks globally as of November 2022. According to reports, the operators of LockBit had made at least $100 million in ransom demands, of which tens of millions had been paid by victims. The arrest followed a 2.5 year investigation into the LockBit ransomware group by the Department of Justice.^[35]

In January 2023, the hacker group claimed to have attacked the French luxury goods company Nuxe^[36] and ELSAN, a French group of private clinics. The hacker group filched 821 GB of data from the company's headquarters.^[37] The same month, Royal Mail's international export services were severely disrupted by a Lockbit ransomware attack.^[38][39]

In February 2023, the group claimed responsibility for an attack on Indigo Books and Music, a chain of Canadian bookstores.^[40]

In March 2023, the group claimed responsibility for attacking BRL Group [fr], a water specialist in France.^[41]

On May 16, 2023, the hacker group claimed responsibility for attacking the Hong Kong branch of the Chinese newspaper China Daily. This is the first time the hacker group has attacked a Chinese company. LockBit does not attack Russian entities and avoids attacking Russian allies.^[42]

In May 2023, the hacker group claimed responsibility for the attack on Voyageurs du Monde [fr]. The hacker group stole some 10,000 identity documents from the company's customer files.^[43]

In June 2023, the United States Department of Justice announced criminal charges against Ruslan Magomedovich Astamirov, a Russian national, for his alleged participation in the LockBit ransomware campaign as an affiliate. The charges allege that Astamirov directly executed at least five ransomware attacks against victims and received a portion of ransom payments in bitcoin.^[44]

At the end of June 2023, the TSMC group fell victim to a ransomware attack via one of its suppliers. LockBit demanded a $70 million ransom.^[45]

In July 2023, LockBit attacked the Port of Nagoya in Japan, which handles 10% of the country's trade. The attack forced a shutdown of container operations.^[46]

In October 2023, LockBit claimed to have stolen sensitive data from Boeing.^[47] Boeing acknowledged they were aware of a cyber incident affecting some of their parts and distribution business a few days later, though it did not affect flight safety; they did not name the suspected attackers.^[48]

In November 2023, LockBit attacked the U.S. subsidiary of the Chinese state-owned Industrial and Commercial Bank of China.^[49] Bloomberg reported that the US unit of ICBC at the time was considered the world's largest lender by assets.^[50]

In November 2023, LockBit released internal data that the group had stolen a month earlier from Boeing onto the Internet.^[51]

In November 2023, the LockBit gang attacked the Chicago Trading Company and Alphadyne Asset Management. Bloomberg reported that the CTC had been hacked in October, and that over the prior year Lockbit had "become the world’s most prolific ransomware group." Since 2020, it had reportedly carried out 1,700 attacks and extorted $91 million, according to the US Cybersecurity and Infrastructure Security Agency.^[52] The Register reported in late November 2023 that LockBit was facing growing internal frustrations, and that its leaders were overhauling some of its negotiation methods with victims in response to the low pay rate achieved.^[53]

In January 2024, the LockBit gang attacked Fulton County computers.^[54][55] The county released a statement on the attack the following month, saying they had not paid the ransom, that it was not associated with the election process, they were not aware of any extraction of sensitive information about citizens or employees.^[54][55]

In May 2024, the LockBit gang claimed responsibility for an attack on Canadian retailer London Drugs, which closed all locations across Canada. LockBit then threatened to release data within 48 hours if a ransom of $25 million was not paid. London Drugs stated that they were "unwilling and unable to pay ransom" to the parties involved. No customer or primary employee data was compromised. On May 23, 2024, the company confirmed that data had been leaked by Lockbit, and that affected employees were being offered identity theft protection services.

In June 2024, the LockBit gang attacked the University Hospital Center in Zagreb, the largest medical facility in Croatia. The cyberattack caused significant disruption, taking the hospital "back 50 years—to paper and pencil". LockBit claimed to have exfiltrated a large number of files, including medical records and employee information, and demanded an undisclosed sum in exchange for not publishing the data. The Croatian government refused the demands.^[56][57]

In March 2025, cybersecurity researchers at Forescout reported that a ransomware group known as Mora_001 had used a variant of LockBit 3.0, also known as LockBit Black, as the foundation for a new strain called SuperBlack. According to The Register, the group modified the original ransomware by removing LockBit branding, changing the ransom note, and adding a custom data exfiltration module. Forescout also noted the presence of a qTox ID previously associated with LockBit, suggesting a possible operational link or shared infrastructure between the groups.^[58]

LockBit-NG-Dev (LockBit 4?)

When the LockBit server was closed down by law enforcement in February 2024, it was found that a new version, LockBit-NG-Dev, probably to be released as LockBit 4.0, had been under advanced development;^[59] Trend Micro published a detailed report on it.^[60]

In December 2024, LockBit announced version 4.0 of its ransomware, set for release in February 2025. The group expanded its dark web infrastructure and shared samples with researchers. The launch followed a major law enforcement takedown that disrupted its operations earlier that year.^[61]

In its 2024 Internet Crime Report, the FBI identified LockBit as the most reported ransomware targeting U.S. critical infrastructure. Cisco Talos likewise ranked LockBit as the top ransomware group by volume, responsible for 16 percent of attacks. Researchers linked its continued activity to the leaked LockBit builder and noted that disruption of the group may have boosted rival operations like Akira and RansomHub.^[62]

Seizure by law enforcement in 2024

On February 19, 2024, the National Crime Agency in collaboration with Europol and other international law enforcement agencies seized control of darknet websites belonging to the LockBit ransomware gang as a part of Operation Cronos.^{[63][64][65][9][10]} An unverified report said that Lockbit had said that its servers running on the programming language PHP had been hit, but that it had backup servers without PHP that were "not touched".^[17] One person was arrested in Ukraine, one in Poland, and two in the United States. Two Russians were also named, but have not been arrested. According to Graeme Biggar, Director General of the National Crime Agency, law enforcement has "taken control of their infrastructure, seized their source code, and obtained keys that will help victims decrypt their systems."^[16] A decryptor for LockBit 3.0 was made using the seized keys and released for free use on No More Ransom.^[66] After the takedown, law enforcement posted information about the group on its dark web site, including that it had at least 188 affiliates.^[11] Law enforcement also obtained 30,000 Bitcoin addresses used for managing the group's profits from ransom payments, which contained 2,200 BTC ($112 million USD).^[67]

Post-seizure activity

As of 22 February 2024 LockBit ransomware was still spreading.^[68][11] On 24 February 2024 a new website claiming to be run by LockBit appeared.^[69] The new site listed more than a dozen alleged victims including the FBI, hospitals and Fulton County, Georgia.^[69] The new site threatened to release information relating to Fulton County unless a ransom was paid by 2 March 2024.^[69] The new site claimed to have the identities of members of a jury in a murder trial.^[69] There was also a threat to release Fulton County documents relating to court cases involving Donald Trump if the ransom wasn't paid.^[69]

On 7 May 2024 charges and sanctions were announced against Dmitry Khoroshev, the alleged administrator and developer of LockBit.^[70][71]

On 21 May 2024, LockBit claimed responsibility for an attack on the corporate offices of Canadian retail chain London Drugs, demanding a payment of $25 million.^[72][73] All London Drugs stores were closed nationwide from 28 April–7 May 2024 due to the attack.^[74][75] London Drugs is refusing to pay the ransom, and stated that customer and "primary employee" data was not compromised.^[72][73]

In June 2024, LockBit claimed responsibility for a major breach of Evolve Bank & Trust,^[76] a partner bank of many financial technology companies including Stripe, Mercury, Affirm, and Airwallex.^[77] The group had threatened to leak data from the US Federal Reserve, but the leaked data appeared to come directly from Evolve, not the Federal Reserve.^[78]

In 2025, the Israeli developer Rostislav Panev was extradited to the United States for participating in the development of Lockbit ransomware, three months after having been charged with the cybercrime connection.^[79] Lockbit was hacked in May 2025, according to analysts.^[80]

In September 2025, security researchers reported the emergence of a new version known as LockBit 5.0, marking the group’s resurgence following the 2024 international law enforcement takedown. The updated variant introduced dedicated payloads for Windows, Linux and VMware ESXi environments, reflecting a continued focus on cross-platform attacks against enterprise networks.^[81]

Technical analyses noted enhanced defense-evasion techniques, including log clearing, Event Tracing for Windows (ETW) patching and extensive obfuscation, as well as the use of XChaCha20 and Curve25519 encryption routines. The multiplatform capability enabled affiliates to conduct coordinated attacks across heterogeneous infrastructures, particularly virtualized environments.^[82]