lockbit Ransomware
Monitorado desde 21/10/2020
0
vítimas registradas
0
nos últimos 30 dias
1
CVEs
—
Última atividade
LockBit is one of the most prolific ransomware groups in history, operating as a full RaaS platform that at its peak accounted for an estimated 44% of all ransomware incidents globally in 2023, targeting virtually every sector worldwide through an affiliate model where developers maintain infrastructure and affiliates conduct intrusions.
Vulnerabilidades citadas para este grupo
CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.
- CVE-2023-4966 Alta · 7.5 KEV Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability
Táticas e técnicas (MITRE ATT&CK)
Initial Access
T1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1566 Phishing Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled Task/Job: Scheduled TaskT1059.001 Command and Scripting Interpreter: PowerShell Persistence
T1547.001 Boot or Logon Autostart Execution: Registry Run Keys Defense Evasion
T1027 Obfuscated Files or InformationT1070.001 Indicator Removal: Clear Windows Event LogsT1562.001 Disable or Modify Tools Credential Access
T1003.001 OS Credential Dumping: LSASS MemoryT1110 Brute Force Discovery
T1046 Network Service DiscoveryT1482 Domain Trust Discovery Lateral Movement
T1021.001 Remote Services: Remote Desktop ProtocolT1021.002 Remote Services: SMB/Windows Admin SharesT1210 Exploitation of Remote Services Collection
T1560.001 Archive Collected Data: Archive via Utility Exfiltration
T1048 Exfiltration Over Alternative ProtocolT1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage Command and Control
T1090.003 Proxy: Multi-hop ProxyT1219 Remote Access Software Impact
T1486 Data Encrypted for ImpactT1489 Service StopT1490 Inhibit System Recovery Vítimas divulgadas em sites de vazamento, segundo o ransomware.live. Não exibimos nomes de vítimas. · Ver no ransomware.live