Lockbit

Category: ransomware · Aliases: ABCD Ransomware, LockBit 2.0, LockBit 3.0, LockBit Black, LockBit Red, Trojan.Ransom.LockBit · Sample count (EMBER 2018): 340 · Enrichment: curated_sourced · Updated: 2026-10-16
Category: RansomwareStatus: Automated SignaturePlatform: WINDOWS, LINUX, VMWARE_ESXIStage: Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Lateral Movement, Exfiltration, Impact🕸 Explore Relationship Graph⚙ API JSON⚡ Sigma Rule💾 YARA RuleOS: Windows 11, Windows 10, Windows Server 2022
Executive Summary
LockBit (first identified in September 2019 as 'ABCD' ransomware) is the most prolific, industrialized Ransomware-as-a-Service (RaaS) operation in cybersecurity history, responsible for thousands of attacks across healthcare, government, manufacturing, and critical infrastructure worldwide.

Table of Contents

Overview

LockBit (first identified in September 2019 as 'ABCD' ransomware) is the most prolific, industrialized Ransomware-as-a-Service (RaaS) operation in cybersecurity history, responsible for thousands of attacks across healthcare, government, manufacturing, and critical infrastructure worldwide. Operated by a threat syndicate known as LockBitSupp, the malware evolved through major technical generations: LockBit 1.0 (ABCD), LockBit 2.0 (LockBit Red), and LockBit 3.0 (LockBit Black), which incorporated leaked source code from the Babuk ransomware framework. LockBit engineered unprecedented encryption speeds: utilizing multi-threaded asynchronous I/O with AES-GCM and ChaCha20 encryption, LockBit can encrypt an entire enterprise workstation in under four minutes. LockBit pioneered automated self-propagation across Windows enterprise domains: upon gaining Domain Administrator credentials, the binary automatically generates and deploys Active Directory Group Policy Objects (GPOs) to disable Windows Defender and execute the ransomware across all domain-joined computers simultaneously. Furthermore, LockBit integrates a customized proprietary data-theft tool named 'StealBit' that exfiltrates multi-gigabyte document repositories directly to attacker servers before encryption for double extortion. In February 2024, an international law enforcement task force comprising the FBI, UK National Crime Agency (NCA), and Europol executed Operation Cronos, seizing LockBit's primary dark web portal, infrastructure, and decryptor keys, followed by CISA Advisory AA23-165A detailing LockBit mitigation guidance.

Known aliases

Threat reports may refer to this family under multiple names:

Family Pedigree & Lineage

Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:

Derived From / Upstream Ancestry: Abcd_Ransomware · Babuk

Known Derivatives & Downstream Variants: Lockbit_1.0 · Lockbit_2.0_Red · Lockbit_3.0_Black · Lockbit_Green

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1486 · T1490 · T1489 · T1021.002 · T1484.001 · T1059.001 · T1562.001 · T1041

→ Explore the complete 226-Technique ATT&CK Threat Matrix

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

MITRE D3FEND™ Defensive Countermeasures

Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):

D3FEND IDCountermeasure NameTacticCountered ATT&CKDefensive Guidance
D3-NBANetwork Behavioral AnalysisDetectT1021.002Enforce SMB message signing, disable legacy SMBv1, and restrict administrative share access (C$, ADMIN$) to dedicated PAM bastion hosts.
D3-EAFEgress Analysis and FilteringIsolateT1041Enforce perimeter TLS inspection and alert on anomalous outbound data volume ratios transmitting over active C2 channels.
D3-PSBLPowerShell Script Block LoggingDetectT1059.001Enable PowerShell event ID 4104 and Constrained Language Mode to neuter obfuscated script payloads.
D3-FAEDFile Alteration Early DetectionDetectT1486Deploy canary files and monitor mass rename/encryption I/O spikes to terminate ransomware threads immediately.
D3-SPPService Protection PoliciesHardenT1489Configure strict DACLs on Windows Service Control Manager to prevent unauthorized termination of antivirus and backup services.
D3-VSSVolume Shadow & Snapshot HardeningHardenT1490Block execution of vssadmin.exe and wmic shadowcopy delete; maintain air-gapped immutable backup repositories.
D3-STASecurity Tool Anti-Tamper EnforcementHardenT1562.001Block unauthorized modification of antivirus registry flags and prevent stopping security agent services.

Exploited Vulnerabilities (CVEs)

This malware family is documented weaponizing the following common vulnerabilities and exposures:

Indicators of Compromise

Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.

File hashes (SHA-256, sample)

Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.

Delivery vectors

Persistence mechanisms

SIEM / EDR Ingestion: Need these reference indicators for threat hunting?

Tiered Detection Rules (Cisco CAIRN Model)

Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:

Tier 1 Primitive Artifact Rule (Fast Triage)

Matches raw strings and file markers. Vulnerable to binary repacking and simple obfuscation.

rule MALWARE_WIN_LOCKBIT_T1_ARTIFACT {
    meta:
        description = "Tier 1 Primitive Artifact: Raw string matches for Lockbit"
        tier = "T1 - Primitive Artifact"
        confidence = "Low-Medium (Fast Triage)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        $s1 = "lockbit" ascii wide nocase
        $s2 = "abcd ransomware" ascii wide nocase
        $s3 = "lockbit 2.0" ascii wide nocase
        $s4 = "lockbit 3.0" ascii wide nocase
        $s5 = "lockbit black" ascii wide nocase
        $s6 = "lockbit red" ascii wide nocase
        $s7 = "trojan.ransom.lockbit" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Tier 2 Behavioral Context Rule (Process Chains & Sigma)

Tracks parent-child process anomalies and suspicious scripting telemetry. Resilient against file renames.

title: SystemHelpDesk Detection - Lockbit (Ransomware) Execution & Triage
id: 2bffbff5-36cd-5c55-a17b-be2eb74a7a5f
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
  with the Lockbit malware family. Detects volume shadow copy deletion, boot status
  tampering, and recovery inhibition characteristic of modern ransomware operations.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/lockbit
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.ransomware
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1486
- attack.t1490
- attack.t1489
- attack.t1021_002
- attack.t1484_001
logsource:
  category: process_creation
  product: windows
detection:
  selection_process:
    Image|endswith:
    - \vssadmin.exe
    - \wmic.exe
    - \wbadmin.exe
    - \bcdedit.exe
    CommandLine|contains:
    - delete shadows
    - shadowcopy delete
    - resize shadowstorage
    - recoveryenabled no
    - ignoreallfailures
  condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: critical

Tier 3 Attribution Fingerprint Rule (High Fidelity)

Deep signature matching distinctive operational fingerprints and payload characteristics.

rule MALWARE_WIN_LOCKBIT_T3_ATTRIBUTION {
    meta:
        description = "Tier 3 Attribution Fingerprint: Heuristic detection for Lockbit tradecraft"
        tier = "T3 - Attribution Fingerprint"
        confidence = "High (Confirmed Family Signature)"
        author = "SystemHelpdesk Threat Research Desk"
        date = "2026-10-14"
    strings:
        // Core family identifier & heuristic payload signatures
        $attrib_str = "lockbit" ascii wide nocase
        $pe_magic = "MZ" ascii
        $net_marker = "http" ascii nocase
    condition:
        uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}
SOC & SIEM Rule Downloads: ⬇ Download YARA Rule (.yar) ⬇ Download Sigma Rule (YAML) ⬇ Download Sigma Rule (JSON) ⚙ Threat Profile API (JSON)

References & External Analysis

North American Authority Advisory (CISA / NIST)

The Cybersecurity and Infrastructure Security Agency (CISA) has published an official US federal advisory on this family, which can be mapped to NIST Cybersecurity Framework (CSF) incident response controls: AA23-165A ↗

Frequently Asked Questions

What is LockBit ransomware and who operates it?

LockBit (first emerging in September 2019 under the name ABCD ransomware) is the most prolific Ransomware-as-a-Service (RaaS) cybercrime syndicate in history. The core group provides advanced encryption payloads, custom data exfiltration tools (StealBit), and leak sites to recruited affiliates who carry out network intrusions. Despite major international law enforcement actions (Operation Cronos in February 2024), fragmented LockBit variants and builder leaks (LockBit 3.0 / LockBit Black) remain actively deployed by multiple threat actors.

How does LockBit achieve automated enterprise-wide propagation?

LockBit revolutionized ransomware speed by automating enterprise lateral movement. Once affiliates gain administrator credentials (via phishing, exposed RDP, or vulnerabilities like Citrix Bleed CVE-2023-4966), LockBit leverages Group Policy Objects (GPOs), PsExec, and PowerShell scripts to push the encryption binary across every domain-joined endpoint simultaneously. It self-propagates across local network shares using ARP table discovery and Server Message Block (SMB) protocols, encrypting thousands of machines in under an hour.

Can files encrypted by LockBit 3.0 (LockBit Black) be decrypted for free?

For modern LockBit 3.0 and LockBit Black attacks utilizing standard public-key cryptography (AES-256 / ChaCha20 combined with RSA/ECC), there is no universal free decryptor available. Decryption requires the private key held by the attackers or seized by law enforcement. However, following Operation Cronos, law enforcement agencies (FBI, Europol, Japanese National Police) released targeted decryption tools for certain victim keys recovered from seized command-and-control infrastructure. Victims should check NoMoreRansom.org before considering any extortion demands.

What is StealBit and how does LockBit conduct double extortion?

StealBit is LockBit's proprietary, high-speed custom data exfiltration utility. Built in C++, StealBit systematically searches local drives and network shares for high-value document extensions (.docx, .pdf, .xlsx, source code, database dumps) and streams the unencrypted files to attacker-controlled cloud servers via HTTP POST requests before encryption begins. Affiliates use this stolen data for double extortion, threatening public release on the LockBit leak site if the ransom is not paid.

How does LockBit neutralize security tools and evade detection?

LockBit employs multiple sophisticated defense evasion techniques: (1) It utilizes the Windows Restart Manager API to identify and terminate processes locking target files (including database engines like SQL and Exchange); (2) It deletes Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disables Windows Startup Recovery; (3) In LockBit 3.0, the payload requires a unique password hash via the command line (-k or -p) to execute, preventing automated sandbox analysis by security vendors; (4) It terminates enterprise endpoint detection and response (EDR) agents using vulnerable signed kernel drivers (BYOVD attacks).

How should an organization respond immediately to an active LockBit intrusion?

Emergency response protocol requires: (1) Immediate Network Isolation: Disconnect infected servers, switches, and workstations from the local LAN and internet to halt automated propagation; (2) Preserve Memory & Logs: Avoid powering off systems abruptly; capture volatile RAM where possible for forensic triage and key extraction; (3) Reset Domain Credentials: Revoke all Active Directory domain admin, service account, and Kerberos ticket-granting accounts; (4) Report to Law Enforcement: Engage national cyber authorities (CISA, FBI, Europol) who maintain key repositories from seized servers; (5) Restore from Immutable Backups: Validate that backups (air-gapped or immutable cloud storage) were not compromised before initiating system rebuilding.

What defensive measures are most effective at stopping LockBit?

Critical defensive controls against LockBit include: (1) Enforcing phishing-resistant Multi-Factor Authentication (MFA) across all VPNs, remote portals, and administrative accounts; (2) Patching perimeter vulnerabilities promptly (particularly Citrix, Fortinet, and VPN gateways); (3) Disabling SMBv1 and restricting SMB/PsExec lateral movement between workstations; (4) Implementing immutable, off-site, and air-gapped backup architectures tested regularly; (5) Deploying modern EDR with attack-surface reduction (ASR) rules blocking unauthorized volume shadow copy manipulation and unapproved LSASS memory access.

How do I remove Lockbit from Windows?

Manual removal of Lockbit is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

What are the main symptoms of a Lockbit infection?

Symptoms of Lockbit can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Protect Your Network Against Ransomwares

Want to prevent Lockbit and similar threats from compromising your organization? Read our comprehensive defensive guide: Ransomware Containment & Incident Response.

📣 Threat Intel Correction or Update?

Notice an outdated IOC, unlisted alias, or disputed attribution? Threat researchers are invited to propose an update on GitHub or contact the SystemHelpDesk research desk. All community revisions are credited in our public CHANGELOG.

Need help with an active incident? Published by the SystemHelpdesk threat intelligence team.

Machine-readable

Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/lockbit.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.

🛡️ Verified Antivirus Support & Customer Assistance

Experiencing issues with unexpected malware infections, persistent adware popups, or security software licensing? Access our verified resolution guides and official customer support helplines:

→ View all 57 TotalAV Antivirus & Security Support Resources