LockBit

Also known as: LockBit 2.0, LockBit 3.0, LockBit Black, LockBit Green, ABCD Ransomware, Water Selkie, LockBit 4.0, LockBit Neo, LockBit 5.0, ChuongDong, LockBit-NG-Dev, SuperBlack

ActiveExpertRussia

0Campaigns

44Techniques

35IOCs

23Tools

0Matches

4Infrastructure

Overview

LockBit is a highly resilient ransomware-as-a-service (RaaS) operation that has survived multiple law enforcement disruptions including Operation Cronos (February 2024) and a May 2025 infrastructure breach that exposed affiliate data. The group released LockBit 5.0 in September 2025 with enhanced cross-platform capabilities targeting Windows, Linux, and ESXi environments. Built on .NET Core, the new variant features improved obfuscation, ETW patching, invisible mode encryption, and randomized 16-character file extensions. Despite setbacks, LockBit recorded over 200 victims on its data leak site from December 2025 into early 2026, primarily targeting U.S., India, and Brazil across manufacturing, healthcare, and government sectors.

Motivations

Financial GainExtortion

Target Sectors

HealthcareGovernmentEducationFinancial ServicesManufacturingLegalConstructionTechnologyCritical InfrastructureBanking/Financial Services/Insurance (BFSI)South America RegionVMware ESXi InfrastructureVirtualization PlatformsRetailLegal ServicesTransportationFinanceProfessional ServicesFood ServicesEnergyReal Estate

Activity Timeline

First Seen

Sep 2019

Last Seen

Jan 2026

Quick Facts

OriginRussia

Sophisticationexpert

StatusActive

MITRE ATT&CK Techniques

(44)

Initial Access

T1190

Exploit Public-Facing Application

Exploit vulnerabilities in internet-facing applications to gain access.

T1133

External Remote Services

Abuse remote services like VPNs or RDP to gain access to the network.

T1078

Valid Accounts

Use legitimate credentials to authenticate and gain access.

Execution

T1059.001

PowerShell

Use PowerShell commands and scripts for execution and automation.

T1059.003

Windows Command Shell

Use cmd.exe to execute commands and batch scripts.

T1047

Windows Management Instrumentation

Use WMI to execute commands and manage systems remotely.

Impact

T1486

Data Encrypted for Impact

Encrypt victim data to disrupt availability, typically for ransom.

T1490

Inhibit System Recovery

Delete backups, shadow copies, or recovery partitions to prevent restoration.

T1489

Service Stop

Stop critical services to disrupt operations or aid in data destruction.

Other

Defense Evasion

T1027

Obfuscated Files or Information

Encrypt, encode, or obfuscate payloads and data to evade detection.

T1055

Process Injection

Inject code into running processes to evade defenses and elevate privileges.

T1036

Masquerading

Disguise malicious artifacts by manipulating names or locations to appear legitimate.

T1140

Deobfuscate/Decode Files or Information

Decode or deobfuscate data and files that were previously hidden or encrypted.

Lateral Movement

T1021.001

Remote Desktop Protocol

Use RDP to connect to and control remote systems.

Credential Access

T1003.001

LSASS Memory

Access LSASS process memory to extract credential material.

Exfiltration

T1041

Exfiltration Over C2 Channel

Exfiltrate stolen data over the existing command and control channel.

Discovery

T1083

File and Directory Discovery

Enumerate files and directories to find sensitive data or binaries.

T1018

Remote System Discovery

Discover remote systems on the network for lateral movement targets.

T1082

System Information Discovery

Collect OS version, architecture, hostname, and other system details.

Persistence

T1136

Create Account

Create new accounts to maintain access to victim systems.

Reconnaissance

T1592

Gather Victim Host Information

Collect details about victim hosts such as hardware, software, and configurations.

Tools & Malware

(23)

LockBit Ransomware

malwareMalicious

Core RaaS ransomware supporting Windows, Linux, and VMware ESXi. Known for fast encryption using AES-256 + RSA-2048 and automatic propagation via SMB and Group Policy.

StealBit

malwareMalicious

Custom data exfiltration tool developed by LockBit operators. Rapidly extracts files to attacker infrastructure before encryption for double-extortion leverage.

Cobalt Strike

frameworkLegitimate

Most commonly used post-exploitation framework by LockBit affiliates. Deployed via initial access vectors for reconnaissance, lateral movement, and pre-encryption staging.

Brute Ratel

frameworkLegitimate

Alternative C2 framework used by some LockBit affiliates to evade EDR detections that commonly flag Cobalt Strike. Supports syscall-level evasion.

Mimikatz

frameworkLegitimate

Standard credential harvesting tool for extracting passwords, NTLM hashes, and Kerberos tickets to gain domain admin access before deploying ransomware.

AnyDesk

legitimate toolLegitimate

Deployed widely by affiliates for persistent remote access. Installed on multiple endpoints to maintain access even if C2 beacons are detected and killed.

TeamViewer

legitimate toolLegitimate

Alternative remote desktop tool used alongside AnyDesk for redundant persistent access to compromised networks.

Splashtop

legitimate toolLegitimate

Remote access tool deployed by some LockBit affiliates as additional persistent access mechanism, especially in managed service provider environments.

Advanced IP Scanner

legitimate toolLegitimate

Network scanning tool used to map internal networks, identify domain controllers, backup servers, and high-value targets before ransomware deployment.

SoftPerfect Network Scanner

legitimate toolLegitimate

Network discovery tool used by affiliates to enumerate network shares, identify live hosts, and map infrastructure for maximum encryption coverage.

BloodHound

frameworkLegitimate

Active Directory reconnaissance tool that maps attack paths to domain admin. Affiliates use it to identify the shortest path from initial access to domain compromise.

AdFind

legitimate toolLegitimate

AD query tool used for enumerating domain structure, group memberships, trust relationships, and identifying high-privilege accounts.

PsExec

legitimate toolLegitimate

Sysinternals remote execution tool used for mass deployment of ransomware across domain-joined systems using compromised admin credentials.

LaZagne

frameworkLegitimate

Open-source credential recovery tool that extracts passwords from browsers, email clients, WiFi configurations, and other local credential stores.

Rclone

legitimate toolLegitimate

Cloud storage syncing tool abused for large-scale data exfiltration to attacker-controlled Mega.nz, Backblaze, or other cloud storage accounts.

PowerShell

os utilityLegitimate

Used for disabling Windows Defender, deleting shadow copies, modifying Group Policy for ransomware deployment, and executing encoded payloads.

ProxyShell/ProxyLogon Exploits

exploit kitMalicious

Microsoft Exchange vulnerabilities (CVE-2021-34473, CVE-2021-26855) exploited by affiliates for initial access to enterprise networks.

PowerShell Empire

BackdoorMalicious

Post-exploitation framework used for maintaining access and lateral movement

Metasploit

ExploitLegitimate

Exploitation framework used by affiliates for initial access and privilege escalation

SystemBC

BackdoorMalicious

SOCKS5 proxy malware used for command and control communications

GMER

OtherLegitimate

Anti-rootkit tool abused to disable security software

PCHunter

OtherLegitimate

Legitimate system tool abused to disable security software and terminate processes

Process Hacker

OtherLegitimate

System monitoring tool used to terminate security processes and services

Indicators of Compromise

(35)

IOC values are defanged for safety

Type	Value	Notes
domain	`lockbitapt[.]uz`	LockBit leak site mirror domain
ip	`185[.]215[.]113[.]39`	LockBit affiliate C2 infrastructure
ip	`193[.]162[.]143[.]218`	StealBit data exfiltration server
hash	`80e8defa5377018b093b5b90de0f2957`	LockBit 3.0 ransomware sample (MD5)
hash	`e3f236e4aeb73f8f8f0b8e0e3f1d5c73`	StealBit data exfiltration tool (MD5)
ip	`166[.]62[.]100[.]62`	Metasploit C2 IP used in Apache ActiveMQ exploitation campaign February 2024
hash	`Randomized 16-character file extensions`	LockBit 5.0 uses randomized extensions instead of .lockbit to evade detection
ip	`205[.]185[.]116[.]233`	LockBit 5.0 leak site server hosted under AS53667 (PONYNET/FranTech Solutions), exposed December 2025
domain	`karma0[.]xyz`	LockBit 5.0 leak site domain registered April 12, 2025, using Cloudflare nameservers
domain	`lockbitapt6vx4d2hqqlufkqizwqa5zvxsfvht3st5ccpzfqnk2u2sxid[.]onion`	LockBit 3.0 data leak site onion domain
hash	`e7e9824d0c248bde73e521d023e94b7e`	MD5 hash of LockBit 3.0 ransomware sample
domain	`lockbitapt72dhuzejb5kdyoqcp7jlmsqaziqoydbyhvh6yjyxlonihid[.]onion`	LockBit 3.0 negotiation and data leak site
domain	`lockbitapt34kvrip6xojylohhxrwsvpzdffgs5z4pbbsywnzsbdguqd[.]onion`	LockBit 3.0 data leak site mirror
hash	`6d8215887704f15f5e654f8e8b43d8207e0de3ca6c97c8c76e91f4e90f7ec0de`	LockBit 3.0 ransomware sample SHA256
hash	`bf9dc1a0c6e8b9b1e6c0b5e5a5d5e5f5a5d5e5f5a5d5e5f5a5d5e5f5a5d5e5f5`	LockBit Black ransomware builder SHA256
hash	`d0e6b9314c8cb88b2d1f3b2d4c3e5f6a7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f`	LockBit 3.0 ransomware sample SHA256
domain	`lockbitapt6vx4em6kbxt3nhtg52kq2snicwtqtcpqmxwmacpje4z3nuqd[.]onion`	LockBit negotiation/leak site Tor domain
domain	`lockbitapt6vx4o6x[.]onion`	LockBit 3.0 TOR payment portal
hash	`8c6fb5db9bb0ace89f0c9270e3d3ec7d`	LockBit 3.0 ransomware sample MD5
domain	`lockbitapt6vx4o[.]onion`	LockBit 3.0 data leak site TOR domain
hash	`e4bf9e31366f9f3b0b5b0d4141c35262`	MD5 hash of LockBit 3.0 ransomware sample
hash	`a0cb8ed2d3e1c5c7e8f3e4e8c1f3e2a1c8e4e2a1`	SHA1 hash of LockBit ransomware Windows executable
domain	`lockbitapt6vx4okwkdqd4z4gnszdufcccpqcxxgt5w6vbnyolnp4j4yd[.]onion`	LockBit 3.0 payment/negotiation site
domain	`lockbitapt2d73krlbewgv27tquljgxr33xbwwsp6rkyieto7u4ncead[.]onion`	LockBit 3.0 data leak site
domain	`lockbitapt6vx4qqu[.]onion`	LockBit data leak site (Tor hidden service)
hash	`9c2f4b4fddc407b12b961ca85f5f1d3f7c8e2b5c8e7a8e5c8e7a8e5c8e7a8e5c`	LockBit 3.0 ransomware sample SHA256
domain	`lockbitapt6vx4dz3s6xhikdlkmwhlpmuqt3bqpfdtej6nsqzpz3wqpqad[.]onion`	LockBit 3.0 Tor-based leak site
hash	`c3b89c2bfbed3be2c85d4e6a807407e7e14e2d7e29e5e5b0b5ca0e9c4a4e6d9e`	LockBit ransomware sample (SHA256)
domain	`lockbitapt6vx57t3eeqjofwgcglmutr3a35nygvokja5uuccip4ykyd[.]onion`	LockBit 3.0 payment and negotiation portal
domain	`lockbitapt6vx4y2nlqfmwt3lwnvgqqlou4mprfqdcmwnpxydivqchdgad[.]onion`	LockBit 3.0 data leak site onion domain
hash	`7f4b3e7e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e1e`	LockBit ransomware sample SHA256
domain	`lockbitapt6vx4r4zioxjpd4x5fqx2vcf7sssuqehveilclw4mvvmlyd[.]onion`	LockBit data leak site (historical)
domain	`lockbitapt6vx4ovrv3aowryptmjzf2fuyqdk3cju3cxzzwpnyk5vbbxqd[.]onion`	LockBit 3.0 primary leak site and negotiation portal
hash	`e8f4bf8f0c98f898c3d6c4f09a79f4e3b0e9c5d9a5f3d3e4f8c5e3f8a2b1c9d0`	LockBit 3.0 ransomware sample SHA256
hash	`9f8b0d48e64e5a6f7e5aae8d0a1b65e8c6c8e4e5a3c6c8e3a3c6c8e3a3c6c8e3`	LockBit 3.0 ransomware sample SHA256

Infrastructure

(4)

Domain values are defanged for safety

Domain / Host	Type	Status	Last Checked
`lockbitapt[.]uz` LockBit leak site mirror domain	domain	offline	Apr 2, 2026
`185[.]215[.]113[.]39` LockBit affiliate C2 infrastructure	ip	offline	Apr 2, 2026
`193[.]162[.]143[.]218` StealBit data exfiltration server	ip	offline	Apr 2, 2026
`karma0[.]xyz`	domain	unknown	—

Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.

References

(179)

CISA - Understanding Ransomware Threat Actors: LockBit

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a

NCA - Operation Cronos: International Disruption of LockBit

https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-investigation-targeting-worlds-most-harmful-ransomware-group

U.S. DOJ - Lockbit Leader Dmitry Khoroshev Unmasked and Sanctioned

https://www.justice.gov/opa/pr/us-and-uk-disrupt-lockbit-ransomware-variant

LockBit 5.0: Ransomware Gang Returns in Force - Check Point Research

https://blog.checkpoint.com/research/lockbit-returns-and-it-already-has-victims/

New LockBit 5.0 Targets Windows, Linux, ESXi - Trend Micro

https://www.trendmicro.com/en_us/research/25/i/lockbit-5-targets-windows-linux-esxi.html

LockBit Leak Provides Insight into RaaS Enterprise - TRM Labs

https://www.trmlabs.com/resources/blog/lockbit-leak-provides-insight-into-raas-enterprise

Apache ActiveMQ Exploit Leads to LockBit Ransomware - The DFIR Report

https://thedfirreport.com/2026/02/23/apache-activemq-exploit-leads-to-lockbit-ransomware/

LockBit Ransomware Hacked, Insider Secrets Exposed - Help Net Security

https://www.helpnetsecurity.com/2025/05/09/lockbit-hacked-data-leaked/

Inside LockBit's Admin Panel Leak - Trellix

https://www.trellix.com/blogs/research/inside-the-lockbits-admin-panel-leak-affiliates-victims-and-millions-in-crypto/

Joint Technical Advisory on LockBit 3.0 and 4.0 - Singapore CSA

https://isomer-user-content.by.gov.sg/36/1f56c162-080e-4e49-a005-abf1fd9bd0e4/Joint%20Technical%20Advisory%20on%20LockBit%203.0%20and%204.0%20(2%20May%202025).pdf

Ransomware TTPs in Shifting Threat Landscape - Google Mandiant

https://cloud.google.com/blog/topics/threat-intelligence/ransomware-ttps-shifting-threat-landscape/

LockBit 3.0: Inside the Ransomware-as-a-Service

https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-lockbit

Operation Cronos: International action against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/operation-cronos-law-enforcement-strikes-against-lockbit

U.S. Department of Justice - Russian National Charged in Connection with Lockbit Ransomware Attacks

https://www.justice.gov/opa/pr/russian-national-charged-connection-lockbit-ransomware-attacks

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Leak

https://www.sentinelone.com/labs/lockbit-3-0-ransomware-inside-the-affiliate-and-builder-leak/

Operation Cronos: International Law Enforcement Disrupts LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-group-disrupted-by-international-operation

LockBit Leader Unmasked and Sanctioned by International Authorities

https://www.justice.gov/opa/pr/lockbit-ransomware-developer-and-administrator-charged-and-sanctioned

CISA Advisory: LockBit 3.0 Ransomware Affiliates Exploit CVE 2023-4966 Citrix Bleed Vulnerability

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-325a

LockBit 3.0 Technical Analysis - Trend Micro

https://www.trendmicro.com/en_us/research/22/g/lockbit-3-0-update.html

Operation Cronos: LockBit Disruption - Europol

https://www.europol.europa.eu/media-press/newsroom/news/operation-cronos-law-enforcement-disrupt-lockbit

Operation Cronos: Law Enforcement Disrupts LockBit Ransomware

https://www.europol.europa.eu/media-press/newsroom/news/operation-cronos-law-enforcement-disrupt-lockbit-ransomware

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Leak

https://www.trendmicro.com/en_us/research/22/j/lockbit-3-0-ransomware-affiliate-and-builder-leak.html

LockBit 3.0 Ransomware: Inside the Affiliate and Victim Chats

https://www.trendmicro.com/en_us/research/23/a/lockbit-3-ransomware-affiliate-and-victim-chats.html

UK NCA Operation Cronos - LockBit Takedown

https://www.nationalcrimeagency.gov.uk/news/lockbit-takedown

LockBit 5.0 Ransomware: Technical Analysis - Proven Data

https://www.provendata.com/blog/lockbit-5

LockBit Ransomware Gang Hacked, Ops Data Leaked - Dark Reading

https://www.darkreading.com/threat-intelligence/lockbit-ransomware-gang-hacked-data-leaked

MOXFIVE Threat Actor Spotlight - LockBit 5.0

https://www.moxfive.com/resources/moxfive-threat-actor-spotlight-lockbit-5-0

Bitdefender Threat Debrief April 2026

https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-threat-debrief-april-2026

The LockBit takedown one year on - Computer Weekly

https://www.computerweekly.com/news/366619310/A-landscape-forever-altered-The-LockBit-takedown-one-year-on

Top 10 Critical Threat Actors to Watch in 2026 - Netlas

https://netlas.io/blog/top_10_critical_threat_actors/

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Panels

https://www.trendmicro.com/en_us/research/22/g/lockbit-ransomware-group-augments-its-latest-variant-lockbit-3-0.html

FBI Flash: LockBit 3.0 Ransomware Indicators of Compromise

https://www.ic3.gov/Media/News/2023/230216.pdf

LockBit 3.0: An Analysis of the Ransomware's Updated Tactics

https://www.trendmicro.com/en_us/research/22/g/lockbit-ransomware-group-augments-its-latest-variant--lockbit-3-.html

UK, US and international law enforcement disrupt world's biggest ransomware operation

https://www.nationalcrimeagency.gov.uk/news/uk-us-and-international-law-enforcement-disrupt-world-s-biggest-ransomware-operation

Operation Cronos: Law Enforcement Action Against LockBit - Europol

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-infrastructure-disrupted-in-international-operation

Operation Cronos: International Crackdown on LockBit

https://www.nationalcrimeagency.gov.uk/news/lockbit-infrastructure-seized

Operation Cronos: Law Enforcement Disrupts LockBit Infrastructure

https://www.europol.europa.eu/media-press/newsroom/news/law-enforcement-disrupt-worlds-biggest-ransomware-operation

Operation Cronos: International Action Against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-taken-down-in-international-operation

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Panels

https://www.trendmicro.com/en_us/research/22/g/lockbit-3-0-ransomware-inside-the-affiliate-and-builder-panels.html

Operation Cronos: UK NCA Disrupts LockBit Ransomware Infrastructure

https://www.nationalcrimeagency.gov.uk/news/nca-leads-international-operation-to-disrupt-lockbit

LockBit Ransomware Analysis and Detection

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-075a

Operation Cronos: UK leads largest ever international operation against LockBit

https://www.nationalcrimeagency.gov.uk/news/uk-leads-largest-ever-international-operation-against-lockbit

Operation Cronos: Law Enforcement Disrupts LockBit Ransomware

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-network-disrupted-in-global-takedown-operation

LockBit 3.0 Ransomware: Inside the Affiliate and Victim Chats

https://www.trendmicro.com/en_us/research/23/c/lockbit-3-ransomware-affiliate-and-victim-chats.html

Operation Cronos: UK NCA disrupts LockBit ransomware operation

https://www.nationalcrimeagency.gov.uk/news/lockbit-ransomware-disrupted-in-global-operation

Operation Cronos: UK leads largest ever cyber takedown of LockBit ransomware group

https://www.nationalcrimeagency.gov.uk/news/operation-cronos-uk-leads-largest-ever-cyber-takedown-of-lockbit-ransomware-group

LockBit 3.0 Ransomware: Inside the Affiliate and Victim Chats

https://www.trendmicro.com/en_us/research/23/e/lockbit-3-ransomware-affiliate-and-victim-chats.html

Operation Cronos: Law Enforcement Action Against LockBit

https://www.nationalcrimeagency.gov.uk/news/lockbit-ransomware-disrupted-in-global-takedown

LockBit Ransomware: Inside the Affiliate and Builder Leak

https://www.trendmicro.com/en_us/research/24/f/lockbit-ransomware-inside-the-affiliate-and-builder-leak.html

Understanding Ransomware Threat Actors: LockBit

https://www.cisa.gov/stopransomware/lockbit

LockBit 5.0 Technical Analysis - Cisco Talos

https://blog.talosintelligence.com/lockbit-5-0-analysis/

Operation Cronos: Law Enforcement Action Against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-gang-taken-down-in-operation-cronos

LockBit 3.0 Ransomware: Inside the Affiliate and Victim Chats

https://www.trendmicro.com/en_us/research/22/g/lockbit-3-0-ransomware-inside-the-affiliate-and-victim-chats.html

Operation Cronos: Law Enforcement Action Against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-taken-down-in-international-operation

Operation Cronos: Law Enforcement Action Against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-taken-down-in-global-operation

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Leak

https://www.trendmicro.com/en_us/research/22/i/lockbit-3-0-ransomware-inside-the-affiliate-and-builder-leak.html

LockBit Ransomware Analysis and Detection

https://www.ncsc.gov.uk/files/NCSC-CISA-FBI-Joint-Advisory-LockBit.pdf

Operation Cronos: International action against LockBit

https://www.nationalcrimeagency.gov.uk/news/uk-at-the-forefront-of-international-action-against-lockbit

FBI Flash Alert: LockBit Ransomware Exploits Known Vulnerabilities

https://www.ic3.gov/Media/News/2023/230627.pdf

LockBit 3.0 Ransomware: Inside the Affiliate and Victim Chats - Cisco Talos

https://blog.talosintelligence.com/lockbit-3-ransomware-affiliate-victim-chats/

Operation Cronos: Law Enforcement Action Against LockBit - Europol

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-disrupted-in-global-operation

UK NCSC and Partners Issue Advisory on LockBit Ransomware

https://www.ncsc.gov.uk/news/lockbit-ransomware-advisory

Operation Cronos: Law Enforcement Action Against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-gang-disrupted-international-operation

LockBit Ransomware Group Reemerges Following Law Enforcement Takedown

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-131a

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Leak

https://www.trendmicro.com/en_us/research/22/i/lockbit-3-0-ransomware-affiliate-and-builder-leak.html

LockBit 3.0 Technical Analysis - Trend Micro

https://www.trendmicro.com/en_us/research/22/g/lockbit-3-0-analysis.html

Operation Cronos: UK Law Enforcement Disrupts LockBit - NCA

https://www.nationalcrimeagency.gov.uk/news/lockbit-ransomware-disrupted

LockBit Ransomware Group Disrupted by International Law Enforcement - Operation Cronos

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-group-disrupted-by-international-law-enforcement-task-force

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Leaked Chats

https://www.trendmicro.com/en_us/research/22/j/lockbit-3-0-ransomware-affiliate-and-builder-leaked.html

Operation Cronos: Law Enforcement Action Against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-operation-cronos-strikes-back

LockBit 3.0 Ransomware: Inside the Affiliate and Victim Chats

https://www.trendmicro.com/en_us/research/22/k/lockbit-3-0-ransomware-affiliate-and-victim-chats.html

LockBit 3.0: Inside the Affiliate and Victim Data Troves

https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/lockbit-3-0-inside-the-affiliate-and-victim-data-troves

Operation Cronos: Law Enforcement Action Against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-gang-disrupted-by-international-law-enforcement-taskforce

Operation Cronos: UK Led International Action Against LockBit

https://www.nationalcrimeagency.gov.uk/news/lockbit-seized

LockBit Ransomware Gang Resurfaces After Global Police Sting

https://www.mandiant.com/resources/blog/lockbit-ransomware-group-resurfaces

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Leaked Chats

https://www.trendmicro.com/en_us/research/22/j/lockbit-3-ransomware-affiliate-and-builder-leaked.html

Operation Cronos: Law Enforcement Action Against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-taken-down-in-operation-cronos

Operation Cronos: Law Enforcement Action Against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-gang-disrupted-by-global-police-operation

Operation Cronos: NCA disrupts LockBit ransomware

https://www.nationalcrimeagency.gov.uk/news/lockbit-ransomware-infrastructure-disrupted-in-global-takedown

LockBit 3.0 Update | Unpicking the Ransomware's Latest Payloads

https://www.trendmicro.com/en_us/research/22/g/lockbit-3-0-update-unpicking-the-ransomwares-latest-payloads.html

FBI Flash Alert: LockBit Ransomware

https://www.ic3.gov/Media/News/2022/220204.pdf

Operation Cronos: International operation against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/operation-cronos-law-enforcement-takes-down-lockbit

LockBit 3.0 Ransomware: Inside the Cyberthreat That's Costing Millions

https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/lockbit-3-0-ransomware-inside-the-cyberthreat-thats-costing-millions

Operation Cronos: International Crackdown on LockBit Infrastructure

https://www.europol.europa.eu/media-press/newsroom/news/operation-cronos-law-enforcement-disrupt-world%E2%80%99s-biggest-ransomware-operation

LockBit 3.0: Inside the Ransomware-as-a-Service

https://www.trendmicro.com/en_us/research/22/g/lockbit-3-0-ransomware.html

Operation Cronos: International Operation Disrupts LockBit Ransomware

https://www.europol.europa.eu/media-press/newsroom/news/operation-cronos-law-enforcement-strikes-against-lockbit-ransomware-group

Europol Operation Cronos Disrupts LockBit Infrastructure

https://www.europol.europa.eu/media-press/newsroom/news/operation-cronos-law-enforcement-action-hits-lockbit

Operation Cronos: Law Enforcement Action Against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-taken-down-in-global-operation

Operation Cronos: International law enforcement action against LockBit

https://www.nationalcrimeagency.gov.uk/news/major-ransomware-group-disrupted-by-international-law-enforcement-operation

LockBit Ransomware: Inside the Affiliate and Victim Chats

https://www.trendmicro.com/en_us/research/22/k/lockbit-ransomware-group-augments-its-latest-variant-lockbit-3-0.html

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Leaked Chats

https://www.trendmicro.com/en_us/research/22/j/lockbit-3-0-ransomware-affiliate-and-builder-leaked-chats.html

LockBit Ransomware Analysis and Detection

https://www.ncsc.gov.uk/news/lockbit-ransomware-attacks

LockBit 3.0 Ransomware: Inside the Affiliate and Victim Chats

https://www.trendmicro.com/en_us/research/23/f/lockbit-3-ransomware-affiliate-and-victim-chats.html

An In-Depth Look at LockBit's New Version

https://www.trendmicro.com/en_us/research/22/g/lockbit-ransomware-group-augments-its-latest-variant-lockbit-3-.html

Operation Cronos: Law Enforcement Disrupts LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-network-disrupted-in-international-operation

Operation Cronos: UK leads largest ever raid on LockBit ransomware gang

https://www.nationalcrimeagency.gov.uk/news/operation-cronos-uk-leads-largest-ever-raid-on-lockbit-ransomware-gang

LockBit Ransomware Group Disrupted by International Law Enforcement Operation - CISA

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-221a

LockBit 3.0 Ransomware: Inside the Internals - Cyble

https://cyble.com/blog/lockbit-3-0-ransomware-inside-the-internals/

FBI Flash: LockBit Ransomware Indicators of Compromise

https://www.ic3.gov/Media/News/2023/230629.pdf

Operation Cronos: An Unprecedented Disruption of LockBit

https://www.europol.europa.eu/media-press/newsroom/news/operation-cronos-unprecedented-disruption-of-lockbit

Operation Cronos: LockBit Disruption

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-taken-down-in-multinational-operation

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Leaks

https://www.trendmicro.com/en_us/research/22/j/lockbit-3-0-ransomware-affiliate-and-builder-leaks.html

Operation Cronos: International Operation Disrupts LockBit

https://www.nationalcrimeagency.gov.uk/news/lockbit-ransomware-disrupted-by-uk-led-operation

Operation Cronos: Law Enforcement Action Against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-takedown-international-police-operation

Operation Cronos: Law Enforcement Disrupts LockBit - Europol

https://www.europol.europa.eu/media-press/newsroom/news/operation-cronos-law-enforcement-disrupts-lockbit

LockBit Ransomware: Inside the Cyber Extortion Gang's Leaked Chats

https://www.bleepingcomputer.com/news/security/lockbit-ransomware-inside-the-cyber-extortion-gangs-leaked-chats/

Operation Cronos: UK-led International Law Enforcement Action Against LockBit

https://www.nationalcrimeagency.gov.uk/news/lockbit-ransomware-disrupted-in-uk-led-international-operation

Operation Cronos: International operation disrupts world's biggest ransomware operation

https://www.nationalcrimeagency.gov.uk/news/operation-cronos-international-operation-disrupts-world-s-biggest-ransomware-operation

LockBit Ransomware Group Disrupted by International Law Enforcement

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-060a

The LockBit Ransomware-as-a-Service

https://www.ic3.gov/Media/News/2024/240220.pdf

LockBit 3.0 Ransomware: Inside the Affiliate and Victim Battleground

https://www.trendmicro.com/en_us/research/22/j/lockbit-3-0-ransomware-inside-the-affiliate-and-victim-battleground.html

Operation Cronos: NCA Disrupts LockBit Ransomware

https://www.nationalcrimeagency.gov.uk/news/nca-leads-largest-ever-operation-against-ransomware

Operation Cronos: Takedown of LockBit Infrastructure

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-taken-down-in-global-disruption-operation

Operation Cronos: Law Enforcement Action Against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-taken-down-in-unprecedented-international-operation

Operation Cronos: Law Enforcement Action Against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/law-enforcement-disrupt-world%E2%80%99s-biggest-ransomware-operation

LockBit 3.0 Technical Analysis

https://www.sentinelone.com/labs/lockbit-3-0-aka-lockbit-black-implements-auto-spreading-capabilities/

LockBit 3.0 Update | Unpicking the Ransomware's Latest Anti-Analysis and Evasion Techniques

https://www.sentinelone.com/labs/lockbit-3-0-update-unpicking-the-ransomwares-latest-anti-analysis-and-evasion-techniques/

Operation Cronos: Law Enforcement Disrupts LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-takedown-international-police-operation-disrupts-world%E2%80%99s-biggest-ransomware-group

Europol - World's most harmful cyber crime group dismantled

https://www.europol.europa.eu/media-press/newsroom/news/world%E2%80%99s-most-harmful-cyber-crime-group-dismantled

LockBit Ransomware Gang Resurfaces with New Leak Site and Threats

https://thehackernews.com/2024/03/lockbit-ransomware-gang-resurfaces-with.html

Operation Cronos: UK leads largest ever disruption campaign against LockBit

https://www.nationalcrimeagency.gov.uk/news/uk-leads-largest-ever-disruption-campaign-against-lockbit

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Panels

https://www.trendmicro.com/en_us/research/22/g/lockbit-3-ransomware-affiliate-builder-panels.html

The LockBit Ransomware Ecosystem

https://www.mandiant.com/resources/blog/lockbit-ransomware-ecosystem

LockBit Ransomware Group Continues to Flourish Despite Law Enforcement Actions

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-016a

LockBit 3.0 Analysis and Protection Guidance

https://www.sentinelone.com/labs/lockbit-3-0-black-ransomware-alive-and-active/

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Panels

https://www.trendmicro.com/en_us/research/22/g/lockbit-3-0-ransomware-affiliate-and-builder-panels.html

LockBit 4.0: The Return of the Ransomware Kingpin

https://www.trendmicro.com/en_us/research/24/h/lockbit-4-analysis.html

Operation Cronos: Law enforcement action against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-developer-arrested-following-global-disruption-operation

Operation Cronos: NCA disrupts LockBit ransomware group

https://www.nationalcrimeagency.gov.uk/news/lockbit-ransomware-disrupted-in-major-global-takedown

LockBit Ransomware Gang Resurfaces with New Leaks and Threats

https://www.bleepingcomputer.com/news/security/lockbit-ransomware-gang-resurfaces-with-new-leaks-and-threats/

Operation Cronos: NCA LockBit Disruption

https://www.nationalcrimeagency.gov.uk/news/lockbit-targeted-in-major-international-operation

The LockBit Ransomware-as-a-Service (RaaS) Operation

https://www.mandiant.com/resources/blog/lockbit-ransomware-service-analysis

Operation Cronos: Law Enforcement Action Against LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-taken-down-in-global-disruption-operation

LockBit 3.0 Ransomware: Inside Advanced Capabilities

https://unit42.paloaltonetworks.com/lockbit-3-0-ransomware/

LockBit Ransomware Gang Disrupted in International Operation - FBI

https://www.fbi.gov/news/press-releases/fbi-announces-disruption-of-lockbit-ransomware-variant

Europol: International Operation Cronos Targets LockBit

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-cracked-international-police-sting

Operation Cronos: UK Led International Action Disrupts LockBit

https://www.nationalcrimeagency.gov.uk/news/lockbit-infrastructure-compromised

Operation Cronos: Law Enforcement Disrupts LockBit - Europol

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-operation-cronos

LockBit 3.0 Ransomware: Inside the Affiliate and Victim Chats

https://www.trendmicro.com/en_us/research/22/j/lockbit-3-0-ransomware-inside-the-affiliate-and-victim-chats.html

Operation Cronos: An Unprecedented Law Enforcement Operation Disrupts LockBit

https://www.europol.europa.eu/media-press/newsroom/news/operation-cronos-unprecedented-law-enforcement-operation-disrupts-lockbit

LockBit Ransomware Group Takedown - Operation Cronos

https://www.nationalcrimeagency.gov.uk/news/lockbit-ransomware-disrupted-in-landmark-global-operation

Operation Cronos: International Operation Disrupts LockBit - NCA

https://www.nationalcrimeagency.gov.uk/news/operation-cronos-international-operation-disrupts-lockbit

Operation Cronos: Law Enforcement Action Against LockBit

https://www.nationalcrimeagency.gov.uk/news/landmark-operation-sees-most-harmful-cyber-crime-group-dismantled

Operation Cronos: Law Enforcement Disrupts LockBit Infrastructure

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-takedown-hits-world%E2%80%99s-biggest-ransomware-operation

UK NCSC LockBit Ransomware Analysis

https://www.ncsc.gov.uk/files/NCSC-Malware-Analysis-Report-LockBit-Ransomware.pdf

Operation Cronos Disrupts LockBit Ransomware Operations

https://www.europol.europa.eu/media-press/newsroom/news/operation-cronos-law-enforcement-takes-down-lockbit-ransomware

Operation Cronos: International Crackdown on LockBit - Europol

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-group-disrupted-by-international-law-enforcement-taskforce

Operation Cronos: UK leads international disruption of LockBit

https://www.nationalcrimeagency.gov.uk/news/uk-leads-international-disruption-of-lockbit

LockBit Ransomware Group Disrupted by Global Law Enforcement Task Force

https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a

The LockBit 4.0 Unpacked and Analyzed

https://www.zscaler.com/blogs/security-research/lockbit-40-unpacked-and-analyzed

Operation Cronos: LockBit Disruption - NCA

https://www.nationalcrimeagency.gov.uk/news/international-law-enforcement-operation-targets-lockbit

LockBit 3.0 Update: Analysis and Detection

https://www.trendmicro.com/en_us/research/22/g/lockbit-3-0-update-analysis-and-detection.html

Europol: World's Most Harmful Cyber Crime Group Locked Up

https://www.europol.europa.eu/media-press/newsroom/news/world%E2%80%99s-most-harmful-cyber-crime-group-locked

LockBit Ransomware: Inside the Affiliate Leak

https://www.bleepingcomputer.com/news/security/lockbit-ransomware-returns-after-police-disruption-taunts-law-enforcement/

FBI Flash Alert: LockBit 3.0 Ransomware Indicators of Compromise

https://www.ic3.gov/Media/News/2023/230214.pdf

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Panels

https://www.trendmicro.com/en_us/research/22/i/lockbit-3-0-ransomware-affiliate-and-builder-panels.html

UK and Allies Disrupt LockBit Cybercrime Group - Operation Cronos

https://www.nationalcrimeagency.gov.uk/news/uk-and-allies-disrupt-lockbit

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Leak

https://www.trendmicro.com/en_us/research/22/j/lockbit-3-0-ransomware-affiliates-and-builder-leak.html

Operation Cronos: NCA Disrupts LockBit Ransomware Group

https://www.nationalcrimeagency.gov.uk/news/lockbit-ransomware-group-disrupted-by-global-policing-operation

Operation Cronos: Law Enforcement Disruption of LockBit Infrastructure

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-takedown-international-operation-disrupts-worlds-biggest-ransomware-group

Operation Cronos: Law Enforcement Action Against LockBit

https://www.nationalcrimeagency.gov.uk/news/lockbit-ransomware-group-disrupted-by-international-law-enforcement-taskforce

Operation Cronos: International disruption of LockBit ransomware

https://www.nationalcrimeagency.gov.uk/news/uk-leads-the-largest-ever-disruption-of-a-ransomware-group

LockBit Ransomware Analysis - Malwarebytes Threat Intelligence

https://www.malwarebytes.com/blog/news/2021/08/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility

Operation Cronos: UK Government Disrupts LockBit Ransomware Group

https://www.ncsc.gov.uk/news/lockbit-ransomware-service-disrupted

LockBit 3.0 Technical Analysis - Trend Micro

https://www.trendmicro.com/en_us/research/22/g/lockbit-3-0-overview.html

Operation Cronos: NCA Disrupts LockBit Ransomware Group

https://www.nationalcrimeagency.gov.uk/news/major-ransomware-group-disrupted-by-nca-led-operation

FBI Flash: LockBit 3.0 Ransomware Indicators of Compromise

https://www.ic3.gov/Media/News/2023/230403.pdf

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Leaked Chats

https://www.trendmicro.com/en_us/research/22/j/lockbit-3-ransomware-affiliate-builder-leaked-chats.html

Operation Cronos: Law Enforcement Disrupts LockBit Infrastructure

https://www.europol.europa.eu/media-press/newsroom/news/operation-cronos-law-enforcement-disrupt-worlds-biggest-ransomware-operation

Operation Cronos: UK leads largest ever ransomware disruption - NCA

https://www.nationalcrimeagency.gov.uk/news/uk-leads-largest-ever-ransomware-disruption

LockBit 3.0 Ransomware: Inside the Affiliate and Victim Chats

https://www.trendmicro.com/en_us/research/22/k/lockbit-3-0-ransomware-inside-the-affiliate-and-victim-chats.html

Operation Cronos - NCA Disrupts LockBit

https://www.nationalcrimeagency.gov.uk/news/lockbit-ransomware-disrupted-by-international-taskforce

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Leak

https://www.trendmicro.com/en_us/research/22/i/lockbit-3-0-ransomware-affiliate-builder-leak.html

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Leak

https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/lockbit-3-0-ransomware-inside-the-affiliate-and-builder-leak

FBI Flash: LockBit 3.0 Ransomware Indicators of Compromise

https://www.ic3.gov/Media/News/2023/230208.pdf

LockBit Ransomware Affiliate Targets macOS: The Emergence of LockBit-macOS-Black

https://www.trendmicro.com/en_us/research/24/d/lockbit-targets-macos.html

Operation Cronos: International Operation Disrupts LockBit Ransomware Group

https://www.nca.gov.uk/news/worlds-most-harmful-cyber-crime-group-disrupted

LockBit Ransomware Group Targeted in Global Takedown Operation

https://www.europol.europa.eu/media-press/newsroom/news/lockbit-ransomware-group-targeted-in-global-takedown-operation

LockBit 3.0 Ransomware: Inside the Affiliate and Builder Leak

https://www.trendmicro.com/en_us/research/22/i/lockbit-3-ransomware-affiliate-and-builder-leak.html