Active ransomware operator
← All groupsLockBit
aka LockBit 3.0, LockBit Black, LockBit Green, ABCD ransomware · 3,536 victims indexed · first seen 6 years ago · last activity 2 months ago
3,536
Victims indexed
#1 of 348 tracked operators
5y 5m
Active period
Oct 2020 → Mar 2026
10
Countries hit
top United States · 364
At a glance
- Status
- active
- Aliases
- LockBit 3.0, LockBit Black, LockBit Green, ABCD ransomware
- First seen
- 6 years ago
- Last activity
- 2 months ago
- Onion sites
- 111 known endpoints
- Primary sector
- Business Services · 185 hits
About
LockBit is a highly prolific ransomware group that emerged in October 2020 and has become one of the most active ransomware operations globally, with over 3,500 documented victims and a primary motivation of financial gain through extortion. The group is suspected to originate from Russia and operates as a Ransomware-as-a-Service (RaaS) model, recruiting affiliates to conduct attacks while providing them with ransomware tools, infrastructure, and support. LockBit primarily gains initial access through exploiting vulnerabilities in public-facing applications, credential stuffing attacks, and phishing campaigns, employing double extortion tactics where they steal sensitive data before encrypting systems and threatening to leak the information if ransom demands are not met. The group has demonstrated significant technical sophistication, developing multiple variants including LockBit 3.0 (also known as LockBit Black), and has been particularly active in targeting business services, manufacturing, technology, and healthcare sectors across the United States, France, Germany, United Kingdom, and Italy. Despite ongoing law enforcement efforts and international cooperation to disrupt their operations, including seizures of infrastructure and arrests of affiliates, LockBit has shown resilience and adaptability, continuing to operate and evolve their tactics while maintaining their position as one of the most dominant ransomware threats in the cybercriminal landscape.
References
119 linksExternal sources curated by the MISP threat-intel community.
- mcafee.com/blogs/other-blogs/mcafee-labs/tales-from-the-trenches-a-lockbit-ransomware-story/
- usa.kaspersky.com/resource-center/threats/lockbit-ransomware
- blog.compass-security.com/2022/03/vpn-appliance-forensics/
- blogs.vmware.com/security/2022/09/esxi-targeting-ransomware-the-threats-that-are-after-your-virtual-machines-part-1.html
- lifars.com/wp-content/uploads/2022/02/LockBitRansomware_Whitepaper.pdf
- security.packt.com/understanding-lockbit/
- socradar.io/lockbit-3-another-upgrade-to-worlds-most-active-ransomware/
- bleepingcomputer.com/news/security/lockbit-victim-estimates-cost-of-ransomware-attack-to-be-42-million/
- crowdstrike.com/blog/better-together-global-attitude-survey-takeaways-2021/
- dragos.com/blog/industry-news/dragos-ics-ot-ransomware-analysis-q4-2021/
- fortinet.com/blog/threat-research/ransomware-roundup-new-variants
- ic3.gov/Media/News/2022/220204.pdf
- microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself
- trellix.com/en-us/about/newsroom/stories/threat-labs/conti-leaks-examining-the-panama-papers-of-ransomware.html
- trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html
- amgedwageh.medium.com/lockbit-ransomware-analysis-notes-93a542fc8511
- analyst1.com/blog/ransom-mafia-analysis-of-the-worlds-first-ransomware-cartel
- analyst1.com/file-assets/RANSOM-MAFIA-ANALYSIS-OF-THE-WORLD%E2%80%99S-FIRST-RANSOMWARE-CARTEL.pdf
- asec.ahnlab.com/en/35822/
- asec.ahnlab.com/ko/39682/
Timeline
24 months2023-10-01T00:00:00+00:002026-03-01T00:00:00+00:00
Top countries
🇺🇸 United States
364
🇫🇷 France
100
🇩🇪 Germany
90
🇬🇧 United Kingdom
86
🇮🇹 Italy
85
🇧🇷 Brazil
60
🇨🇦 Canada
49
🇮🇳 India
49
Top sectors
Business Services
185
Technology
124
Not Found
109
Manufacturing
108
Healthcare
80
Government
71
Transportation/Logistics
34
Financial Services
27
MITRE ATT&CK
12 techniques · 10 tacticsTactics
Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessLateral MovementCollectionExfiltrationImpact
Techniques
- T1190Exploit Public-Facing Application
- T1133External Remote Services
- T1566Phishing
- T1059Command and Scripting Interpreter
- T1053Scheduled Task/Job
- T1548Abuse Elevation Control Mechanism
- T1562Impair Defenses
- T1003OS Credential Dumping
- T1021Remote Services
- T1486Data Encrypted for Impact
- T1490Inhibit System Recovery
- T1048Exfiltration Over Alternative Protocol
Indicators of compromise
CVEs exploited
Known tools
Cobalt StrikeMimikatzPsExecAnyDeskMega.nz
File hashes
- SHA256 e3f236e4aeb73f8f8f0b71a6d2bc1f4b0b70b31c45cb850038c779df72e64e4cLockBit 3.0 builder
- SHA256 a56b41a6023f828cccaaef470b52aec30f07f64c3e3e5ace4c5a3f77ec04e150LockBit ransomware payload
Domains
- lockbitapt.onion
- lockbit7bb4b6n27feok2rc7ri75udaqkfppjvtkxlwh7qldygbopmad.onion
Detection · YARA rules
2 rulesLockbit2_Jul21
YARA rule from ATR/Trellix: ransomware/RANSOM_Lockbit2.yar
source: ATR/Trellix
to
YARA rule from ATR/Trellix: ransomware/RANSOM_Lockbit2.yar
source: ATR/Trellix
Recent victims
Loading…
Onion infrastructure
111 known- http://lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion
- http://lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion
- http://lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion
- http://lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion
- http://lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion
- http://lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion
- http://lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion
- http://lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion
- http://lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion
- http://lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion
- http://lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion
- http://lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion
- + 99 more endpoints
Source
Updated 2 months agoData on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.