LockBit 3.0 / Black Technical Intelligence Dossier

Executive Summary & Threat Architecture

LockBit (first identified in September 2019 as 'ABCD' ransomware) is the most prolific, industrialized Ransomware-as-a-Service (RaaS) operation in cybersecurity history, responsible for thousands of attacks across healthcare, government, manufacturing, and critical infrastructure worldwide. Operated by a threat syndicate known as LockBitSupp, the malware evolved through major technical generations: LockBit 1.0 (ABCD), LockBit 2.0 (LockBit Red), and LockBit 3.0 (LockBit Black), which incorporated leaked source code from the Babuk ransomware framework. LockBit engineered unprecedented encryption speeds: utilizing multi-threaded asynchronous I/O with AES-GCM and ChaCha20 encryption, LockBit can encrypt an entire enterprise workstation in under four minutes. LockBit pioneered automated self-propagation across Windows enterprise domains: upon gaining Domain Administrator credentials, the binary automatically generates and deploys Active Directory Group Policy Objects (GPOs) to disable Windows Defender and execute the ransomware across all domain-joined computers simultaneously. Furthermore, LockBit integrates a customized proprietary data-theft tool named 'StealBit' that exfiltrates multi-gigabyte document repositories directly to attacker servers before encryption for double extortion. In February 2024, an international law enforcement task force comprising the FBI, UK National Crime Agency (NCA), and Europol executed Operation Cronos, seizing LockBit's primary dark web portal, infrastructure, and decryptor keys, followed by CISA Advisory AA23-165A detailing LockBit mitigation guidance.

Observed Threat Aliases: LockBit 3.0, LockBit Black, LockBit 2.0, LockBit Red, ABCD Ransomware, Trojan.Ransom.LockBit

Ancestry & Lineage Tracking

Derived From / Upstream Ancestry: abcd_ransomware, babuk

Documented Downstream Variants: lockbit_1.0, lockbit_2.0_red, lockbit_3.0_black, lockbit_green

Weaponized Vulnerabilities & Exploitation Topology

Documented common vulnerabilities and exposures (CVEs) weaponized by LockBit 3.0 / Black operators for initial execution, sandbox evasion, or SYSTEM-level kernel privilege escalation:

→ Explore all 77 exploited vulnerabilities on the SystemHelpDesk CVE Threat Matrix Hub.

MITRE ATT&CK® Tactical Tradecraft

Tactics, techniques, and procedures (TTPs) systematically mapped across real-world intrusion kill-chains:

→ Inspect the complete 226-technique matrix on the MITRE ATT&CK Defense Hub.

Indicators of Compromise (IOCs) & Forensic Artifacts

Curated indicators for retrospective threat hunting across SIEM and EDR platforms:

Initial Delivery Vectors

• Compromised Remote Desktop Protocol (RDP) credentials bought from initial access brokers
• Phishing attachments delivering malicious ZIP and ISO containers exploiting CVE-2023-38831
• Automated Active Directory Group Policy Object (GPO) propagation

Host Persistence & Execution Hooks

• Creation of auto-starting services in Windows Service Manager with random string names
• Registry Run keys under HKLM\Software\Microsoft\Windows\CurrentVersion\Run
• Scheduled task execution under system privileges via schtasks /create /ru SYSTEM

Reference File Hashes (SHA-256)

• a17387f5df2307ef086915091219b671a172776c59b67195721118182969b761
• 2b6a5db21d00f7e44a42e5d7db69b466ea2084c55bc66c5d1e2e1329c31b312b
• e5f492a5d2073fbcfd06ec4a29a1b15112028ddc87c14a22ad31737be70d8a57