LockBit 2.0

MITRE ATT&CK: S1199 View on attack.mitre.org

Aliases: LockBit 2.0

First seen
2021-06-01 00:00:00
Malware type
ransomware
Family
Malware family
Operating systems
windows
Profile updated
2026-07-07 13:46:47

Targeted industries: energy-and-utilities financial-services government-and-public-sector healthcare-and-pharmaceutical manufacturing retail-and-hospitality technology-and-telecommunications transportation-and-logistics

Context

LockBit 2.0 is an affiliate-based Ransomware-as-a-Service (RaaS) that has been in use since at least June 2021 as the successor to LockBit Ransomware. LockBit 2.0 has versions capable of infecting Windows and VMware ESXi virtual machines, and has been observed targeting multiple industry verticals globally.

Detection coverage

  • 1 YARA rules
  • 809 Sigma rules

Malware & tools used

  • Hidden Window (attack-pattern)
  • Registry Run Keys / Startup Folder (attack-pattern)
  • Scheduled Task (attack-pattern)
  • Windows Command Shell (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • Service Stop (attack-pattern)
  • Bypass User Account Control (attack-pattern)
  • Create Account (attack-pattern)
  • Modify Registry (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Deobfuscate/Decode Files or Information (attack-pattern)
  • Process Discovery (attack-pattern)
  • File and Directory Discovery (attack-pattern)
  • Group Policy Modification (attack-pattern)
  • Peripheral Device Discovery (attack-pattern)
  • Network Share Discovery (attack-pattern)
  • Local Storage Discovery (attack-pattern)
  • Clear Windows Event Logs (attack-pattern)
  • Windows Management Instrumentation (attack-pattern)
  • Execution Guardrails (attack-pattern)
  • System Language Discovery (attack-pattern)
  • File Deletion (attack-pattern)
  • SMB/Windows Admin Shares (attack-pattern)
  • Data Encrypted for Impact (attack-pattern)
  • PowerShell (attack-pattern)

Detection rules

  • R3C0NST_Stealbit (yara-rule)

Reports & references

  • Palo Alto Unit 42 — Lockbit 2 Ransomware (report)
  • MITRE ATT&CK — S1199 (report)
  • ic3.gov — 220204 (report)

External references