LockBit (Windows)

Aliases: ABCD Ransomware

Malware type
ransomware
Family
Malware family
Last IoC activity
2026-07-22 04:04:50
Profile updated
2026-07-07 12:47:15

Targeted industries: financial-services government-and-public-sector healthcare-and-pharmaceutical manufacturing technology-and-telecommunications transportation-and-logistics

Context

LockBit is a ransomware family known for targeting various industries globally, encrypting files and demanding ransom payments. It has evolved over time, using advanced encryption techniques to pressure victims into paying for the decryption key.

Used by threat actors

Exploited vulnerabilities

  • CVE-2023-27350 (vulnerability)

Reports & references

  • CrowdStrike — Double Trouble Ransomware Data Leak Extortion Part 1 (report)
  • CrowdStrike — Better Together Global Attitude Survey Takeaways 2021 (report)
  • socradar.io — Lockbit 3 Another Upgrade To Worlds Most Active Ransomware (report)
  • security.packt.com — Understanding Lockbit (report)
  • Trend Micro — Ransomware Spotlight Lockbit (report)
  • Microsoft — Ransomware As A Service Understanding The Cybercrime Gig Economy And How To Protect Yourself (report)
  • sentinelone.com — Lockbit Ransomware Side Loads Cobalt Strike Beacon With Legitimate Vmware Utility (report)
  • glimps.fr — Lockbit3 0 (report)
  • intrinsec.com — Alphv Ransomware Gang Analysis (report)
  • lemagit.fr — Ransomware Lockbit 30 Commence A Etre Utilise Dans Des Cyberattaques (report)
  • mbsd.jp — Mbsd Whitepaper A Deep Dive Analysis Of Lockbit2.0 Ransomware (report)
  • netskope.com — Netskope Threat Coverage Lockbit (report)
  • prodaft.com — Lockbit Case Report Tlpwhite (report)
  • sentinelone.com — Living Off Windows Defender Lockbit Ransomware Sideloads Cobalt Strike Through Microsoft Security Tool (report)
  • sentinelone.com — Lockbit 3 0 Update Unpicking The Ransomwares Latest Anti Analysis And Evasion Techniques (report)
  • Trend Micro — Iocs Thwarting Loaders Socgholish Blister.Txt (report)
  • Trend Micro — Thwarting Loaders From Socgholish To Blisters Lockbit Payload (report)
  • Trend Micro — Lockbit Resurfaces With Version 2 0 Ransomware Detections In Chi (report)
  • Trend Micro — Thwarting Loaders From Socgholish To Blisters Lockbit Payload (report)
  • Trend Micro — Lockbit Ransomware Group Augments Its Latest Variant Lockbit 3 (report)
  • Trend Micro — Lockbit Conti And Blackcat Lead Pack Amid Rise In Active Raas And Extortion Groups Ransomware In Q1 2022 (report)
  • youtube.com — Watch (report)
  • zdnet.com — Ransomware Hits Helicopter Maker Kopter (report)
  • yoroi.company — Hunting The Lockbit Gangs Exfiltration Infrastructures (report)
  • intrinsec.com — Tlp Clear 31072025 Shadowsyndicate Infrastructure Illumination En (report)

External references