LockBit is a ransomware family and ransomware-as-a-service operation that became one of the most prolific extortion threats of the early 2020s.
Profile source: Mallory opens in a new tabLockBit
LockBit is a ransomware family and ransomware-as-a-service operation that became one of the most prolific extortion threats of the early 2020s. Active from 2020 through 2024 as a dominant criminal enterprise, it used an affiliate model in which operators supplied ransomware tooling and infrastructure to partners who conducted intrusions and deployed the encryptor against victim environments worldwide. LockBit was responsible for attacks against thousands of organizations across many sectors and countries, and it generated hundreds of millions of dollars in ransom payments.
LockBit is best known for file encryption and extortion. Public reporting also established that the operation retained stolen victim data despite promises to delete it after payment, demonstrating a double-extortion component and unreliable post-payment behavior. Variants associated with LockBit 3 were widely circulated, and the 2022 leak of the LockBit builder enabled third parties to generate custom versions, lowering the barrier to reuse by unrelated actors. Incident reporting from 2025 and 2026 shows continued use of custom LockBit 3 builds by financially motivated intruders after obtaining privileged access in victim networks.
The malware and its ecosystem have been associated with Windows attacks for years, and later reporting also described cross-platform capability spanning Linux and VMware ESXi in post-Cronos “LockBit 5.0” activity. Observed intrusions involving LockBit deployments relied heavily on hands-on-keyboard tradecraft rather than autonomous worming, including use of valid accounts for access, manual lateral movement, remote administration tooling such as PsExec, and scripts to weaken endpoint protections and enable remote access before encryption. In at least one documented case, investigators found no evidence of data exfiltration despite successful encryption, indicating that affiliate behavior varied by intrusion.
In February 2024, Operation Cronos, a multinational law-enforcement action, disrupted LockBit by seizing core infrastructure including its leak site, control systems, and source code, and by undermining affiliate trust in the brand. The operation significantly degraded LockBit’s credibility and attack volume, although later reporting described attempts to revive the brand under a new version label. LockBit remains one of the most recognizable ransomware names because of its scale, affiliate-driven operating model, and lasting influence on the ransomware ecosystem.
48b0a4505a96a640300e43e2af7122768f718979876dd1050ce4f729d69e00722513d6678b476a432af2e84fff485b44c462c6b02b35df2910689947c5090faee47032b3d1b9cbbcf77741d5d260004d95daa771a28eaed76eb01e1e8f403f7cca93d47bcc55e2e1bd4a679afc8e2e25a1539b21e5d6849a3e0cf87a4dc703355e1f61b9c1c27cad3b7a81c804ac7b86274e5ff2aa33e7ec980700e617eb2214Reported operators
Ce groupe utilisait auparavant des ransomwares tiers (RedAlert, LockBit, Babuk).
In a real-world case, evidence was found that the threat actor, believed to be UAT-8099, used LockBit 3.0 Ransomware; after uploading a web shell, they attempted to gain control and manipulate SEO using Potato, AnyDesk, GotoHTTP, LCX, the NPS client (npc.Exe), BadIIS...
The LockBit ransomware group, active since around 2019... In December 2024, the group announced its newest ransomware version, “Lockbit 4”. Lockbit 4 has two versions, Black and Green, In this article we will analyze the green version.
LockBit 3.0 affiliates are exploiting CVE-2023–4966, known as Citrix Bleed, in Citrix Netscaler web app delivery control (ADC) and Gateway appliances.
We investigated a recent LockBit extortion incident that occurred in Q3 2023... In September 2019, Cybereason found this hostname in old LockBit 2.0 extortions...
CYBLE identified the DragonForce ransomware binary as being based on LockBit 3.0 (Black) ransomware.
The attackers used a version of the popular LockBit 3.0 ransomware, compiled from publicly available source code, to encrypt the data.
The CyberVolk collective is a prime example of how readily threat actors can access and deploy dangerous ransomware builders such as AzzaSec, Diamond, LockBit, Chaos and others.
Talos IR responded to Warlock, Babuk, and Kraken ransomware variants for the first time, while also responding to previously seen families Qilin and LockBit.
As in previous attacks, they encrypted data using variants of LockBit 3.0 (for Windows systems) and Babuk (for NAS devices).
NullBulge is delivering LockBit ransomware payloads to their Async and Xworm victims as a later-stage infection.
During a recent investigation, our DFIR team discovered that LockBit Ransomware-as-a-Service (Raas) side-loads Cobalt Strike Beacon through a signed VMware xfer logs command line utility.
As the final payload, the group used the well-known ransomware LockBit 3.0 and Babuk.
As the final payload, the group used the well-known ransomware LockBit 3.0 and Babuk.
UNC3753 traces back to the now-defunct Conti ransomware gang, sharing overlaps with UNC2686, which ran BazarCall-style campaigns from 2021. The group deployed LockBit Black in 2022 but dropped ransomware entirely after that, focusing purely on data theft and extortion.
The GOLD MYSTIC threat group has operated the LockBit name-and-shame ransomware-as-a-service (RaaS) scheme since mid-2019, exploiting unauthorized access to thousands of organizations to deploy ransomware and steal data to facilitate the extortion of victims.
Authorities say Matveev played a major role in the development and deployment of the Hive, LockBit and Babuk ransomware variants...
Impact T1486 Data Encrypted for Impact PhantomCore использовали LockBit 3.0 для шифрования трафика
Around November 2021, DEV-0243 started to deploy the LockBit 2.0 RaaS payload in their intrusions. ... In a notable shift ... DEV-0401 started deploying LockBit 2.0 ransomware payloads in April 2022.
Around November 2021, DEV-0243 started to deploy the LockBit 2.0 RaaS payload in their intrusions. ... In a notable shift ... DEV-0401 started deploying LockBit 2.0 ransomware payloads in April 2022.
CosmicBeetle, an immature ransomware threat actor using its own signature encryptor, ScRansom, and the leaked LockBit 3.0 builder, became an affiliate of RansomHub.
According to their posts on Exploit, Wazawaka has worked with at least two different ransomware affiliate programs, including LockBit. Wazawaka said LockBit had paid him roughly $500,000 in commissions for the six months leading up to September 2020.
Groups including UAC-0238 exploited exposed RDP services to push ransomware variants such as X2anylock, Warlock, and LockBit 3.0 into compromised environments.
LockBit posted 163 victims in Q1 2026, climbing to fourth place globally.
The vulnerability was attributed to Lace Tempest, a Cl0p ransomware affiliate, in April 2023, used in campaigns delivering Cl0p and LockBit ransomware payloads.
...or generated using the leaked LockBit Black builder.
"In 2024, a member of Evil Corp was identified as an affiliate of the LockBit ransomware-as-a-service (RaaS) scheme."
The attackers used a version of the popular LockBit 3.0 ransomware, compiled from publicly available source code, to encrypt the data.
...delivering various ransomware payloads over the years, including ... LockBit ... ransomware...; ...DragonForce... using a variant of the leaked LockBit3.0 builder...
"...others support or sell ESXi encryptors like Akira, Black Basta, Babuk, Lockbit, and Kuiper."
"...others support or sell ESXi encryptors like Akira, Black Basta, Babuk, Lockbit, and Kuiper."
"...others support or sell ESXi encryptors like Akira, Black Basta, Babuk, Lockbit, and Kuiper."
UNC2465, which used the Darkside and Lockbit ransomware...
Bl00Dy ... used open-source and leaked builders from other operators, including LockBit, Babuk and Conti. From September 2022, the group used the LockBit ransomware builder in its attacks... Similarly, the DragonForce ransomware binary was also revealed to have been likely generated using the LockBit Black builder.
...Bearlyfy that has used ransomware strains like LockBit 3.0 and Babuk...
The LockBit gang began its operation in September 2019 and was first known as “ABCD ransomware.” ... Over the next six months, LockBit worked on a new project, internally referred to as “LockBit Red,” and publicly known as “LockBit 2.0.” ... LockBit officially announced another major release ... LockBit Black (publicly known as LockBit 3.0).
The LockBit gang began its operation in September 2019 and was first known as “ABCD ransomware.” ... Over the next six months, LockBit worked on a new project, internally referred to as “LockBit Red,” and publicly known as “LockBit 2.0.” ... LockBit officially announced another major release ... LockBit Black (publicly known as LockBit 3.0).
Lockers such as Babuk and LockBit.
The ransomware strain observed in these incidents closely resembles LockBit 3.0 (LockBit Black).
Exploited software
MITRE ATT&CK
Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.
