LockBit
activeAlso known as: LockBit 3.0, LockBit Black
LockBit is a Ransomware-as-a-Service (RaaS) operation that has been one of the most prolific ransomware groups globally. Known for its fast encryption speed and double extortion tactics, LockBit operates an affiliate program and maintains a leak site for publishing stolen data.
First Seen
2019-09
Last Activity
2025-01
Target Regions
4 regions
Industries
5 sectors
HealthcareManufacturingFinancial ServicesGovernmentEducation
Attack Chain (MITRE ATT&CK)
Visual representation of the attack phases and techniques used by LockBit
Click on a phase to view details and MITRE ATT&CK technique IDs
Tactics & Techniques
MITRE ATT&CK mapped tactics and techniques used by this threat actor
| Technique ID | Name | Tactic | Description | Reference |
|---|---|---|---|---|
| T1566 | Phishing | Initial Access | Sends malicious emails with weaponized attachments or links | MITRE |
| T1190 | Exploit Public-Facing Application | Initial Access | Exploits vulnerabilities in VPN, RDP, and web applications | MITRE |
| T1059.001 | PowerShell | Execution | Uses PowerShell for payload execution and reconnaissance | MITRE |
| T1003 | OS Credential Dumping | Credential Access | Dumps credentials from LSASS memory | MITRE |
| T1486 | Data Encrypted for Impact | Impact | Encrypts files using AES and RSA encryption | MITRE |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies and backup catalogs | MITRE |
Indicators of Compromise (IOCs)
Known IOCs associated with LockBit operations
| Type | Value | Description | Last Seen | Actions |
|---|---|---|---|---|
| hash | a89f42c4e42a0f7d7d3e6e9f8e7f8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d | LockBit 3.0 ransomware executable | 2025-01-15 | |
| domain | lockbit-decryptor[.]top | Payment portal domain | 2025-01-10 | |
| ip | 185.220.101[.]1 | C2 server IP address | 2025-01-12 | |
| filename | lockbit.exe | Common payload filename | — | |
| filename | restore-my-files.txt | Ransom note filename | — |
IOCs are defanged for safety. Click copy to get the clean value.
Detection Guidance
SIEM and EDR detection recommendations for identifying LockBit activity
- 1Monitor for vssadmin.exe deleting shadow copies
- 2Detect PowerShell execution with encoded commands
- 3Alert on bcdedit.exe modifying boot configuration
- 4Monitor for mass file modifications with encryption-related extensions
- 5Detect credential dumping from LSASS process
- 6Alert on disabling of Windows Defender or other AV
Mitigation, Containment & Recovery
Step-by-step guidance for responding to and recovering from this ransomware attack
- 1Isolate affected systems from the network immediately
- 2Disable RDP and remote access services
- 3Block known IOCs at the firewall and proxy
- 4Preserve system memory and disk images for forensics
- 5Notify incident response team and management