Loading malware…
LockBit 3.0, also known as LockBit 3 Black, is ransomware associated with the LockBit ransomware-as-a-service ecosystem. A builder for the platform leaked publicly in 2022, enabling other threat actors to create and deploy ransomware derived from it. Pro-Ukrainian groups, including Bearlyfy, have used LockBit 3 Black to encrypt data in attacks against Russian organizations before transitioning toward modified or internally developed ransomware. The malware has also been cited as a widely available ransomware codebase from which newer encryptors have drawn inspiration.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Изначально для шифрования данных Bearlyfy использовали LockBit 3 Black и свою доработанную версию Babuk.
1 distinct technique documented for this family, organized by ATT&CK tactic.
Bearlyfy has carried out more than 70 cyberattacks against Russian companies over the past year and is now escalating its campaign with newly developed ransomware tools... Since early March, Bearlyfy has used a custom-built Windows ransomware strain known as GenieLocker... Earlier Bearlyfy attacks relied heavily on existing ransomware tools... LockBit 3 Black... On Linux systems, the group deployed a modified version of the Babuk ransomware. | The group’s primary goals are both financial and political. They appear to be causing “maximum damage” to Russian companies while also generating revenue through ransomware payments.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Publicly available ransomware mentioned as tooling that pro-Ukrainian hacktivist groups have reportedly moved away from in favor of internally developed malware.
Widely available ransomware mentioned as software that some pro-Ukrainian groups have stopped using in favor of custom malware.
A ransomware family referenced as both a formerly popular encryptor among pro-Ukrainian groups and a technical basis for newer ransomware and propagation tooling.
A ransomware variant built using the leaked LockBit ransomware-as-a-service builder and used by Bearlyfy in earlier attacks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.