LockBit

Core RaaS ransomware supporting Windows, Linux, and VMware ESXi. Known for fast encryption using AES-256 + RSA-2048 and automatic propagation via SMB and Group Policy.

Custom data exfiltration tool developed by LockBit operators. Rapidly extracts files to attacker infrastructure before encryption for double-extortion leverage.

Most commonly used post-exploitation framework by LockBit affiliates. Deployed via initial access vectors for reconnaissance, lateral movement, and pre-encryption staging.

Alternative C2 framework used by some LockBit affiliates to evade EDR detections that commonly flag Cobalt Strike. Supports syscall-level evasion.

Standard credential harvesting tool for extracting passwords, NTLM hashes, and Kerberos tickets to gain domain admin access before deploying ransomware.

Deployed widely by affiliates for persistent remote access. Installed on multiple endpoints to maintain access even if C2 beacons are detected and killed.

Alternative remote desktop tool used alongside AnyDesk for redundant persistent access to compromised networks.

Remote access tool deployed by some LockBit affiliates as additional persistent access mechanism, especially in managed service provider environments.

Network scanning tool used to map internal networks, identify domain controllers, backup servers, and high-value targets before ransomware deployment.

Network discovery tool used by affiliates to enumerate network shares, identify live hosts, and map infrastructure for maximum encryption coverage.

Active Directory reconnaissance tool that maps attack paths to domain admin. Affiliates use it to identify the shortest path from initial access to domain compromise.

AD query tool used for enumerating domain structure, group memberships, trust relationships, and identifying high-privilege accounts.

Sysinternals remote execution tool used for mass deployment of ransomware across domain-joined systems using compromised admin credentials.

Open-source credential recovery tool that extracts passwords from browsers, email clients, WiFi configurations, and other local credential stores.

Cloud storage syncing tool abused for large-scale data exfiltration to attacker-controlled Mega.nz, Backblaze, or other cloud storage accounts.

Used for disabling Windows Defender, deleting shadow copies, modifying Group Policy for ransomware deployment, and executing encoded payloads.

Microsoft Exchange vulnerabilities (CVE-2021-34473, CVE-2021-26855) exploited by affiliates for initial access to enterprise networks.

Post-exploitation framework used for maintaining access and lateral movement