LockBit

LockBit is a prolific cybercriminal ransomware-as-a-service operation that has been one of the most active and recognizable extortion threats globally since its emergence in 2019. It operates through a core development and management team supported by affiliates who conduct intrusions, steal data, deploy ransomware, and negotiate extortion demands. The group is widely associated with double-extortion operations that combine file encryption with threats to publish stolen information, and it has repeatedly demonstrated the ability to rebrand, rebuild infrastructure, and continue operations after disruption.

LockBit is commonly referenced through multiple versioned and branding variants, including LockBit, LockBit 2.0, LockBit 3.0, LockBit Black, LockBit Green, and more recent references to LockBit 5.0. “LockBit Black” is broadly associated with the LockBit 3.0 generation. Reporting also frequently distinguishes the core operation from its affiliates, reflecting the group’s franchise-like operating model.

The operation has targeted organizations across a wide range of sectors and geographies, including manufacturing, government, healthcare, technology, retail, consulting, education, and critical services. Victimology has historically been heavily weighted toward the United States, but more recent reporting indicates broader international distribution, with sustained activity across Europe, Latin America, and Asia. LockBit has remained a significant share-holder in the ransomware ecosystem even during periods when newer groups such as Qilin or The Gentlemen surpassed it in public victim claims.

LockBit’s tradecraft is consistent with mature RaaS operations. Public reporting has linked the broader operation or its affiliates to exploitation of exposed remote access services, abuse of valid accounts, lateral movement over enterprise administration channels, and use of legitimate tools for reconnaissance, remote access, and data exfiltration. Observed behaviors associated with LockBit activity include use of Remote Desktop Protocol in intrusions and use of legitimate file-transfer software to support exfiltration. The group is also associated with rapid operational tempo once access is established, pressure-driven negotiations, and public leak-site shaming intended to coerce payment.

LockBit has been repeatedly connected to the wider Russian-speaking cybercrime ecosystem. It is not generally described as a state-directed espionage actor; rather, it is a financially motivated criminal enterprise. At the ecosystem level, infrastructure and service providers linked to LockBit have included bulletproof hosting operators and other criminal enablers that also serviced major ransomware and malware groups. Law-enforcement actions, sanctions, and infrastructure seizures have targeted both LockBit itself and parts of this enabling network, but the operation has shown resilience through affiliate mobility, reconstitution, and continued branding evolution.

LockBit remains a high-profile ransomware threat because of its scale, affiliate model, broad targeting, and ability to persist despite sustained international disruption efforts.