lockbit Ransomware
Tracked since Oct 21, 2020
0
victims recorded
0
in the last 30 days
1
CVEs
—
Last activity
LockBit is one of the most prolific ransomware groups in history, operating as a full RaaS platform that at its peak accounted for an estimated 44% of all ransomware incidents globally in 2023, targeting virtually every sector worldwide through an affiliate model where developers maintain infrastructure and affiliates conduct intrusions.
Vulnerabilities cited for this group
CVEs associated with the group by ransomware.live. Records not yet published here appear without a link.
- CVE-2023-4966 High · 7.5 KEV Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
Tactics and techniques (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1566 Phishing Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled Task/Job: Scheduled TaskT1059.001 Command and Scripting Interpreter: PowerShell Persistence
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys Defense Evasion
T1027 Obfuscated Files or InformationT1070.001 Indicator Removal: Clear Windows Event LogsT1562.001 Disable or Modify Tools Credential Access
T1003.001 OS Credential Dumping: LSASS MemoryT1110 Brute Force Discovery
T1046 Network Service DiscoveryT1482 Domain Trust Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin SharesT1210 Exploitation of Remote Services Collection
T1560.001 Archive Collected Data: Archive via Utility Exfiltration
T1048 Exfiltration Over Alternative ProtocolT1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1090.003 Proxy: Multi-hop ProxyT1219 Remote Access Software Impact
T1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System Recovery Victims posted on leak sites, according to ransomware.live. Victim names are not displayed. · View on ransomware.live