LockBit

Aliases: ABCD ransomware

Malware type
ransomware
Family
Malware family
Related IoCs
190 (174 malicious)
Last IoC activity
2026-10-18 01:56:50
Profile updated
2026-07-07 12:47:20

Targeted industries: financial-services healthcare-and-pharmaceutical manufacturing technology-and-telecommunications retail-and-hospitality education-and-nonprofits government-and-public-sector

Context

LockBit operators tend to be very indiscriminate and opportunistic in their targeting. Actors behind this attack will use a variety of methods to gain initial access, up to and including basic methods such as brute force. After gaining initial access the actor follows a fairly typical escalation, lateral movement and ransomware execution playbook. LockBit operators tend to have a very brief dwell time, executing the final ransomware payload as quickly as they are able to. LockBit ransomware has the built-in lateral movement features; given adequate permissions throughout the targeted environment.

Detection coverage

  • 11 YARA rules

Used by threat actors

  • LockBit Affiliate Citrix Bleed Exploits (campaign)
  • BITWISE SPIDER (threat-actor)

Detection rules

  • CAPE_Lockbit (yara-rule)
  • MALPEDIA_Win_Lockbit_Auto (yara-rule)
  • SIGNATURE_BASE_APT_RANSOM_Lockbit_Forensicartifacts_Nov23 (yara-rule)
  • SIGNATURE_BASE_MAL_SUSP_RANSOM_Lockbit_Ransomnote_Feb24 (yara-rule)
  • SIGNATURE_BASE_MAL_RANSOM_Lockbit_Indicators_Feb24 (yara-rule)
  • SIGNATURE_BASE_MAL_RANSOM_LNX_Macos_Lockbit_Apr23_1 (yara-rule)
  • SIGNATURE_BASE_MAL_RANSOM_Lockbit_Apr23_1 (yara-rule)
  • SIGNATURE_BASE_MAL_RANSOM_Lockbit_Locker_LOG_Apr23_1 (yara-rule)
  • SIGNATURE_BASE_MAL_RANSOM_Lockbit_Forensicartifacts_Apr23_1 (yara-rule)
  • CRAIU_Crime_Lockbit3_Ransomware (yara-rule)
  • RUSSIANPANDA_Win_Ransom_Lockbit5 (yara-rule)

Related threat objects

Reports & references

  • CrowdStrike — Double Trouble Ransomware Data Leak Extortion Part 1 (report)
  • CrowdStrike — Better Together Global Attitude Survey Takeaways 2021 (report)
  • socradar.io — Lockbit 3 Another Upgrade To Worlds Most Active Ransomware (report)
  • security.packt.com — Understanding Lockbit (report)
  • Trend Micro — Ransomware Spotlight Lockbit (report)
  • analyst1.com — Ransom Mafia Analysis Of The Worlds First Ransomware Cartel (report)
  • Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
  • sentinelone.com — Lockbit Ransomware Side Loads Cobalt Strike Beacon With Legitimate Vmware Utility (report)
  • CrowdStrike — Report2021Gtr (report)
  • Mandiant — Unc2165 Shifts To Evade Sanctions (report)
  • Cisco Talos — Ctir Quarterly Trends Q4 2020 (report)
  • intel471.com — Conti Ransomware Cooperation Maze Lockbit Ragnar Locker (report)
  • trellix.com — Conti Leaks Examining The Panama Papers Of Ransomware (report)
  • media.kasperskycontenthub.com — Common Ttps Of The Modern Ransomware Low Res (report)
  • Kaspersky — 106824 (report)
  • medium.com — W4 July En Story Of The Week Ransomware On The Darkweb C61965D0386A (report)
  • bleepingcomputer.com — The Week In Ransomware April 1St 2022 I Can Fight With A Keyboard (report)
  • McAfee — Tales From The Trenches A Lockbit Ransomware Story (report)
  • usa.kaspersky.com — Lockbit Ransomware (report)
  • blog.compass-security.com — Vpn Appliance Forensics (report)
  • lifars.com — Lockbitransomware Whitepaper (report)
  • bleepingcomputer.com — Lockbit Victim Estimates Cost Of Ransomware Attack To Be 42 Million (report)
  • dragos.com — Dragos Ics Ot Ransomware Analysis Q4 2021 (report)
  • fortinet.com — Ransomware Roundup New Variants (report)
  • ic3.gov — 220204 (report)

External references