Ce groupe utilisait auparavant des ransomwares tiers (RedAlert, LockBit, Babuk).
LockBit
LockBit is a prominent ransomware family and ransomware-as-a-service operation that has existed in multiple major iterations, including LockBit 2.0, LockBit 3.0/LockBit Black, and later LockBit 5.0 branding.
Profile source: Mallory opens in a new tabLockBit
Family profile
LockBit is a prominent ransomware family and ransomware-as-a-service operation that has existed in multiple major iterations, including LockBit 2.0, LockBit 3.0/LockBit Black, and later LockBit 5.0 branding. It is widely associated with financially motivated extortion activity and has been one of the most prolific ransomware brands targeting enterprise environments worldwide. LockBit is known for rapid file encryption, broad impact across Windows environments, and continued adaptation of evasion and operational techniques over time.
LockBit has been used both by its core operators and by affiliates, and the leaked LockBit 3.0 builder enabled additional actors to generate custom variants derived from the family. Reporting in 2025 and 2026 continued to identify custom ransomware samples built from the leaked LockBit 3.0 builder in real intrusions, indicating that the family’s codebase remained influential even after major law-enforcement disruption.
Observed behavior associated with LockBit includes encryption of enterprise systems, manual or automated spread within compromised networks, and pre-encryption impairment of defenses. Later variants have been noted for interfering with Windows telemetry mechanisms such as Event Tracing for Windows, reducing visibility for security monitoring products. LockBit has also been associated with techniques to bypass user account control and with broader defense-evasion tradecraft common to mature ransomware operations.
LockBit has been linked to data-theft extortion practices in addition to encryption. LockBit 3.0 has been specifically noted as using peer-to-peer and torrent-based distribution of stolen data to amplify pressure on victims and complicate takedown or containment. Information exposed after the 2024 Operation Cronos law-enforcement action indicated that victim data had been retained despite promises of deletion, underscoring the unreliability of post-payment assurances in LockBit-related extortion.
The family primarily targets Windows systems, though its broader ecosystem and derivatives have influenced other ransomware development. LockBit has affected a wide range of sectors globally, including education and industrial organizations, and remains a major reference point in the evolution of modern ransomware tradecraft despite sustained disruption efforts.
Capabilities
- Defense Evasion
- Exfiltration
- Extortion
- Lateral Movement
Operational record
1
YARA rules
26
Leak sites
19 available
Reported operators
Threat actors
39 named in public reportingIn a real-world case, evidence was found that the threat actor, believed to be UAT-8099, used LockBit 3.0 Ransomware; after uploading a web shell, they attempted to gain control and manipulate SEO using Potato, AnyDesk, GotoHTTP, LCX, the NPS client (npc.Exe), BadIIS...
The LockBit ransomware group, active since around 2019... In December 2024, the group announced its newest ransomware version, “Lockbit 4”. Lockbit 4 has two versions, Black and Green, In this article we will analyze the green version.
LockBit 3.0 affiliates are exploiting CVE-2023–4966, known as Citrix Bleed, in Citrix Netscaler web app delivery control (ADC) and Gateway appliances.
We investigated a recent LockBit extortion incident that occurred in Q3 2023... In September 2019, Cybereason found this hostname in old LockBit 2.0 extortions...
CYBLE identified the DragonForce ransomware binary as being based on LockBit 3.0 (Black) ransomware.
The attackers used a version of the popular LockBit 3.0 ransomware, compiled from publicly available source code, to encrypt the data.
The CyberVolk collective is a prime example of how readily threat actors can access and deploy dangerous ransomware builders such as AzzaSec, Diamond, LockBit, Chaos and others.
Talos IR responded to Warlock, Babuk, and Kraken ransomware variants for the first time, while also responding to previously seen families Qilin and LockBit.
As in previous attacks, they encrypted data using variants of LockBit 3.0 (for Windows systems) and Babuk (for NAS devices).
NullBulge is delivering LockBit ransomware payloads to their Async and Xworm victims as a later-stage infection.
During a recent investigation, our DFIR team discovered that LockBit Ransomware-as-a-Service (Raas) side-loads Cobalt Strike Beacon through a signed VMware xfer logs command line utility.
As the final payload, the group used the well-known ransomware LockBit 3.0 and Babuk.
As the final payload, the group used the well-known ransomware LockBit 3.0 and Babuk.
UNC3753 traces back to the now-defunct Conti ransomware gang, sharing overlaps with UNC2686, which ran BazarCall-style campaigns from 2021. The group deployed LockBit Black in 2022 but dropped ransomware entirely after that, focusing purely on data theft and extortion.
The GOLD MYSTIC threat group has operated the LockBit name-and-shame ransomware-as-a-service (RaaS) scheme since mid-2019, exploiting unauthorized access to thousands of organizations to deploy ransomware and steal data to facilitate the extortion of victims.
Authorities say Matveev played a major role in the development and deployment of the Hive, LockBit and Babuk ransomware variants...
Impact T1486 Data Encrypted for Impact PhantomCore использовали LockBit 3.0 для шифрования трафика
Around November 2021, DEV-0243 started to deploy the LockBit 2.0 RaaS payload in their intrusions. ... In a notable shift ... DEV-0401 started deploying LockBit 2.0 ransomware payloads in April 2022.
Around November 2021, DEV-0243 started to deploy the LockBit 2.0 RaaS payload in their intrusions. ... In a notable shift ... DEV-0401 started deploying LockBit 2.0 ransomware payloads in April 2022.
CosmicBeetle, an immature ransomware threat actor using its own signature encryptor, ScRansom, and the leaked LockBit 3.0 builder, became an affiliate of RansomHub.
According to their posts on Exploit, Wazawaka has worked with at least two different ransomware affiliate programs, including LockBit. Wazawaka said LockBit had paid him roughly $500,000 in commissions for the six months leading up to September 2020.
Groups including UAC-0238 exploited exposed RDP services to push ransomware variants such as X2anylock, Warlock, and LockBit 3.0 into compromised environments.
LockBit posted 163 victims in Q1 2026, climbing to fourth place globally.
The vulnerability was attributed to Lace Tempest, a Cl0p ransomware affiliate, in April 2023, used in campaigns delivering Cl0p and LockBit ransomware payloads.
...or generated using the leaked LockBit Black builder.
"In 2024, a member of Evil Corp was identified as an affiliate of the LockBit ransomware-as-a-service (RaaS) scheme."
The attackers used a version of the popular LockBit 3.0 ransomware, compiled from publicly available source code, to encrypt the data.
...delivering various ransomware payloads over the years, including ... LockBit ... ransomware...; ...DragonForce... using a variant of the leaked LockBit3.0 builder...
"...others support or sell ESXi encryptors like Akira, Black Basta, Babuk, Lockbit, and Kuiper."
"...others support or sell ESXi encryptors like Akira, Black Basta, Babuk, Lockbit, and Kuiper."
"...others support or sell ESXi encryptors like Akira, Black Basta, Babuk, Lockbit, and Kuiper."
UNC2465, which used the Darkside and Lockbit ransomware...
Bl00Dy ... used open-source and leaked builders from other operators, including LockBit, Babuk and Conti. From September 2022, the group used the LockBit ransomware builder in its attacks... Similarly, the DragonForce ransomware binary was also revealed to have been likely generated using the LockBit Black builder.
...Bearlyfy that has used ransomware strains like LockBit 3.0 and Babuk...
The LockBit gang began its operation in September 2019 and was first known as “ABCD ransomware.” ... Over the next six months, LockBit worked on a new project, internally referred to as “LockBit Red,” and publicly known as “LockBit 2.0.” ... LockBit officially announced another major release ... LockBit Black (publicly known as LockBit 3.0).
The LockBit gang began its operation in September 2019 and was first known as “ABCD ransomware.” ... Over the next six months, LockBit worked on a new project, internally referred to as “LockBit Red,” and publicly known as “LockBit 2.0.” ... LockBit officially announced another major release ... LockBit Black (publicly known as LockBit 3.0).
Lockers such as Babuk and LockBit.
The ransomware strain observed in these incidents closely resembles LockBit 3.0 (LockBit Black).
Exploited software
Vulnerabilities linked to LockBit
26 CVEs CVE-2023-4966 CitrixBleed CVE-2023-46604 Apache ActiveMQ OpenWire Unauthenticated Remote Code Execution CVE-2021-44228 Log4Shell CVE-2024-55591 Authentication Bypass in FortiOS and FortiProxy Node.js WebSocket Module CVE-2023-3519 Unauthenticated RCE in Citrix NetScaler ADC and NetScaler Gateway CVE-2019-7481 SQL Injection in SonicWall SMA100 CVE-2021-20028 SQL Injection in SonicWall Secure Remote Access (SRA) CVE-2025-53770 ToolShell unauthenticated RCE in Microsoft SharePoint Server CVE-2025-6264 Privilege Escalation in Rapid7 Velociraptor Admin.Client.UpdateClientConfig Artifact CVE-2025-53771 Path Traversal Spoofing Vulnerability in Microsoft Office SharePoint CVE-2018-13379 Fortinet FortiOS SSL VPN Path Traversal Credential Exposure CVE-2023-27350 PaperCut MF/NG Authentication Bypass and RCE CVE-2023-27351 Authentication Bypass in PaperCut NG/MF SecurityRequestFilter CVE-2025-24472 FortiOS and FortiProxy Security Fabric Authentication Bypass CVE-2022-41082 ProxyNotShell RCE in Microsoft Exchange Server CVE-2022-41040 ProxyNotShell SSRF in Microsoft Exchange Server CVE-2022-21969 RCE in Microsoft Exchange Server (CVE-2022-21969) CVE-2023-3824 Stack Buffer Overflow in PHP PHAR Directory Entry Parsing CVE-2026-1731 Pre-auth OS Command Injection RCE in BeyondTrust Remote Support and Privileged Remote Access CVE-2025-49704 Remote Code Execution in Microsoft SharePoint Server CVE-2025-49706 Improper Authentication Spoofing in Microsoft Office SharePoint CVE-2024-37085 Authentication Bypass in VMware ESXi Active Directory Integration CVE-2024-1708 ConnectWise ScreenConnect Path Traversal CVE-2020-1472 Zerologon CVE-2024-1709 Authentication Bypass in ConnectWise ScreenConnect CVE-2026-27446 Authentication bypass in Apache Artemis Core downstream federation
MITRE ATT&CK
LockBit in ATT&CK
114 distinct techniquesTechniques
114 techniques T1027 Obfuscated Files or Information T1562 Impair Defenses T1070.001 Clear Windows Event Logs T1112 Modify Registry T1486 Data Encrypted for Impact T1586 Compromise Accounts T1569.002 Service Execution T1021.001 Remote Desktop Protocol T1195 Supply Chain Compromise T1537 Transfer Data to Cloud Account T1204.002 Malicious File T1560 Archive Collected Data T1219 Remote Access Tools T1491.001 Internal Defacement T1059.003 Windows Command Shell T1036 Masquerading T1218.007 Msiexec T1021.002 SMB/Windows Admin Shares T1070.004 File Deletion T1070 Indicator Removal T1027.007 Dynamic API Resolution T1071 Application Layer Protocol T1489 Service Stop T1560.001 Archive via Utility T1622 Debugger Evasion T1105 Ingress Tool Transfer T1572 Protocol Tunneling T1543.003 Windows Service T1657 Financial Theft T1059 Command and Scripting Interpreter T1567.002 Exfiltration to Cloud Storage T1048 Exfiltration Over Alternative Protocol T1548.002 Bypass User Account Control T1204 User Execution T1189 Drive-by Compromise T1041 Exfiltration Over C2 Channel T1567 Exfiltration Over Web Service T1087.001 Local Account T1087.002 Domain Account T1053.005 Scheduled Task T1484.001 Group Policy Modification T1003.001 LSASS Memory T1135 Network Share Discovery T1047 Windows Management Instrumentation T1078.002 Domain Accounts T1218.003 CMSTP T1490 Inhibit System Recovery T1078.001 Default Accounts T1119 Automated Collection T1055 Process Injection T1485 Data Destruction T1190 Exploit Public-Facing Application T1608.001 Upload Malware T1106 Native API T1566.004 Spearphishing Voice T1547.001 Registry Run Keys / Startup Folder T1132 Data Encoding T1562.001 Disable or Modify Tools T1583 Acquire Infrastructure T1505.003 Web Shell T1057 Process Discovery T1074 Data Staged T1497 Virtualization/Sandbox Evasion T1082 System Information Discovery T1027.013 Encrypted/Encoded File T1140 Deobfuscate/Decode Files or Information T1071.001 Web Protocols T1497.001 System Checks T1020 Automated Exfiltration T1620 Reflective Code Loading T1133 External Remote Services T1083 File and Directory Discovery T1561 Disk Wipe T1059.004 Unix Shell T1055.012 Process Hollowing T1614.001 System Language Discovery T1614 System Location Discovery T1562.004 Disable or Modify System Firewall T1078 Valid Accounts T1203 Exploitation for Client Execution T1570 Lateral Tool Transfer T1566 Phishing T1016 System Network Configuration Discovery T1110 Brute Force T1573 Encrypted Channel T1027.002 Software Packing T1654 Log Enumeration T1053 Scheduled Task/Job T1564.003 Hidden Window T1018 Remote System Discovery T1562.002 Disable Windows Event Logging T1559.001 Component Object Model T1134.001 Token Impersonation/Theft T1546.015 Component Object Model Hijacking T1548 Abuse Elevation Control Mechanism T1562.009 Safe Mode Boot T1120 Peripheral Device Discovery T1574 Hijack Execution Flow T1007 System Service Discovery T1059.001 PowerShell T1592 Gather Victim Host Information T1222.001 Windows File and Directory Permissions Modification T1491 Defacement T1547 Boot or Logon Autostart Execution T1480 Execution Guardrails T1132.001 Standard Encoding T1078.003 Local Accounts T1136 Create Account T1573.001 Symmetric Cryptography T1680 Local Storage Discovery T1480.002 Mutual Exclusion T1547.004 Winlogon Helper DLL T1134 Access Token Manipulation T1561.001 Disk Content Wipe
