Skip to main content
Darkfield

Operator dossier

LockBit (also tracked as LockBit 3.0, LockBit Black, LockBit Green, ABCD ransomware) is a ransomware operator currently active on public leak sites. Darkfield has indexed 3,536 public victims claimed by this operator between October 21, 2020 and March 30, 2026. LockBit is a highly prolific ransomware group that emerged in October 2020 and has become one of the most active ransomware operations globally, with over 3,500 documented victims and a primary motivation of financial gain through extortion. The group is suspected to originate from Russia and operates as a Ransomware-as-a-Service (RaaS) model, recruiting affiliates to conduct attacks while providing them with ransomware tools, infrastructure, and support. LockBit primarily gains initial access through exploiting vulnerabilities in public-facing applications, credential stuffing attacks, and phishing campaigns, employing double extortion tactics where they steal sensitive data before encrypting systems and threatening to leak the information if ransom demands are not met. The group has demonstrated significant technical sophistication, developing multiple variants including LockBit 3.0 (also known as LockBit Black), and has been particularly active in targeting business services, manufacturing, technology, and healthcare sectors across the United States, France, Germany, United Kingdom, and Italy. Despite ongoing law enforcement efforts and international cooperation to disrupt their operations, including seizures of infrastructure and arrests of affiliates, LockBit has shown resilience and adaptability, continuing to operate and evolve their tactics while maintaining their position as one of the most dominant ransomware threats in the cybercriminal landscape.

Most-targeted sectors

Most-affected countries

Recent disclosures by LockBit

Most recent 150 of 3,536 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for LockBit →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Active ransomware operator

← All groups

LockBit

aka LockBit 3.0, LockBit Black, LockBit Green, ABCD ransomware · 3,536 victims indexed · first seen 6 years ago · last activity 4 months ago

3,536
Victims indexed
#1 of 364 tracked operators
5y 5m
Active period
Oct 2020 → Mar 2026
10
Countries hit
top United States · 364

At a glance

Status
active
Aliases
LockBit 3.0, LockBit Black, LockBit Green, ABCD ransomware
First seen
6 years ago
Last activity
4 months ago
Onion sites
111 known endpoints
Primary sector
Business Services · 185 hits

About

LockBit is a highly prolific ransomware group that emerged in October 2020 and has become one of the most active ransomware operations globally, with over 3,500 documented victims and a primary motivation of financial gain through extortion. The group is suspected to originate from Russia and operates as a Ransomware-as-a-Service (RaaS) model, recruiting affiliates to conduct attacks while providing them with ransomware tools, infrastructure, and support. LockBit primarily gains initial access through exploiting vulnerabilities in public-facing applications, credential stuffing attacks, and phishing campaigns, employing double extortion tactics where they steal sensitive data before encrypting systems and threatening to leak the information if ransom demands are not met. The group has demonstrated significant technical sophistication, developing multiple variants including LockBit 3.0 (also known as LockBit Black), and has been particularly active in targeting business services, manufacturing, technology, and healthcare sectors across the United States, France, Germany, United Kingdom, and Italy. Despite ongoing law enforcement efforts and international cooperation to disrupt their operations, including seizures of infrastructure and arrests of affiliates, LockBit has shown resilience and adaptability, continuing to operate and evolve their tactics while maintaining their position as one of the most dominant ransomware threats in the cybercriminal landscape.

References

119 links

External sources curated by the MISP threat-intel community.

Timeline

24 months
2023-10-01T00:00:00+00:00 · 662023-11-01T00:00:00+00:00 · 1132023-12-01T00:00:00+00:00 · 862024-01-01T00:00:00+00:00 · 1742024-02-01T00:00:00+00:00 · 1262024-03-01T00:00:00+00:00 · 572024-04-01T00:00:00+00:00 · 262024-05-01T00:00:00+00:00 · 1772024-06-01T00:00:00+00:00 · 172024-07-01T00:00:00+00:00 · 402024-08-01T00:00:00+00:00 · 342024-09-01T00:00:00+00:00 · 122024-10-01T00:00:00+00:00 · 42024-11-01T00:00:00+00:00 · 62024-12-01T00:00:00+00:00 · 72025-01-01T00:00:00+00:00 · 102025-02-01T00:00:00+00:00 · 82025-03-01T00:00:00+00:00 · 62025-04-01T00:00:00+00:00 · 152025-05-01T00:00:00+00:00 · 82025-12-01T00:00:00+00:00 · 932026-01-01T00:00:00+00:00 · 82026-02-01T00:00:00+00:00 · 342026-03-01T00:00:00+00:00 · 4
2023-10-01T00:00:00+00:002026-03-01T00:00:00+00:00

Top countries

🇺🇸 United States
364
🇫🇷 France
100
🇩🇪 Germany
90
🇬🇧 United Kingdom
86
🇮🇹 Italy
85
🇧🇷 Brazil
60
🇨🇦 Canada
49
🇮🇳 India
49
United States dossier →France dossier →Germany dossier →United Kingdom dossier →

Top sectors

Business Services
185
Technology
124
Manufacturing
108
Healthcare
80
Government
71
Transportation/Logistics
34
Financial Services
27
Agriculture and Food Production
26
Business Services dossier →Technology dossier →Manufacturing dossier →Healthcare dossier →

MITRE ATT&CK

12 techniques · 10 tactics

Tactics

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessLateral MovementCollectionExfiltrationImpact

Techniques

  • T1190Exploit Public-Facing Application
  • T1133External Remote Services
  • T1566Phishing
  • T1059Command and Scripting Interpreter
  • T1053Scheduled Task/Job
  • T1548Abuse Elevation Control Mechanism
  • T1562Impair Defenses
  • T1003OS Credential Dumping
  • T1021Remote Services
  • T1486Data Encrypted for Impact
  • T1490Inhibit System Recovery
  • T1048Exfiltration Over Alternative Protocol

Indicators of compromise

Known tools

Cobalt StrikeMimikatzPsExecAnyDeskMega.nz

File hashes

  • SHA256 e3f236e4aeb73f8f8f0b71a6d2bc1f4b0b70b31c45cb850038c779df72e64e4c
    LockBit 3.0 builder
  • SHA256 a56b41a6023f828cccaaef470b52aec30f07f64c3e3e5ace4c5a3f77ec04e150
    LockBit ransomware payload

Domains

  • lockbitapt.onion
  • lockbit7bb4b6n27feok2rc7ri75udaqkfppjvtkxlwh7qldygbopmad.onion

Detection · YARA rules

2 rules

  • Lockbit2_Jul21

    YARA rule from ATR/Trellix: ransomware/RANSOM_Lockbit2.yar

    source: ATR/Trellix

  • to

    YARA rule from ATR/Trellix: ransomware/RANSOM_Lockbit2.yar

    source: ATR/Trellix

Recent victims

Loading…

Onion infrastructure

111 known
  • http://lbb2llze7ab4rnq4jumsy4ihsqzpuysaofpz2e43foocwmrzsokumqid.onion
  • http://lbb47q2f7nzeatj6mxppuk7bhnvwu23mf6pfuywxcz57dwnzl6z3ksqd.onion
  • http://lbb5cnqexve2wg6acbfyohkzeijflpqmgijx5ksyvu4aljv27r2lgiid.onion
  • http://lbb6ud2vyf23z4hw6fzskr5gru7eftbjfbd6yzra3hzuqqvjy63blqqd.onion
  • http://lbbchnkrhkjtltjunmqsbw32bbblsd5bd2pqywtt2bex4bjmo5ry2iqd.onion
  • http://lbbellr6aq4kuchzy44pmimszfd4di4fslez765ux4kse3o4lxcnpgid.onion
  • http://lbbfsazjqqwvtq2ckhm53kfmvsy7c6sdci3uy6qui4lv66aeef7hhpad.onion
  • http://lbbgv7wsi6bpguvjbu6omdgwzllqm5tvdo65do2q7vw4er7aqrnjmtad.onion
  • http://lbbjmbkvw3yurmnazwkbj5muyvw5dd6y7hyxrus23y33qiqczclrnbyd.onion
  • http://lbbk5lfftmhhu2qtahhg4wpnxw4bmtzoy5mu7g4jwyfyeyqoe3vpl4yd.onion
  • http://lbbov7weoojwnqytnjqygmglkwtim5dvyw3xvoluk5ostz75ofd6enqd.onion
  • http://lbbp2rsfcmg5durpwgs22wxrdngsa4wiwmc4xk6hgmuluy6bvbvvtlid.onion
  • + 99 more endpoints

Source

Updated 4 months ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time LockBit posts a victim.

Add LockBit to your watchlist — Pro pings you within 5 minutes of any new LockBit leak-site post, Telegram callout, or affiliate-rebrand inference.