The Demon LockBit, Prince of the Leak Sites

Legend

Appearing in 2019, it became the world's most deployed ransomware in 2022 and 2023, with an affiliate programme run like a company. On 19–20 February 2024, in Operation Cronos, the UK's NCA, the FBI and international partners took over its infrastructure and exposed its secrets. It tried to rise again, with much less strength.

Exorcism

Cast it out with the basics done well: MFA everywhere, fast patching of exposed devices, least privilege. Offline, immutable backups take away the blackmail's power.

Technical record

Also known as: ABCD ransomware, LockBit 2.0, LockBit 3.0, LockBit Black
Circle: Circle III · Ransomware and extortion
First seen: 2019
Status: Exorcised (Operation Cronos, 2024-02-19)
Weapons (exploited CVEs): Saint Citrix Bleed, Who Leaked the Session Tokens · Saint Log4Shell, Martyr of JNDI
Works: The Miracle of Operation Cronos

A ransomware-as-a-service operation first seen in 2019 that became the most deployed ransomware worldwide in 2022-2023. In Operation Cronos the UK NCA, FBI and international partners took control of its infrastructure on 19-20 February 2024, recovered decryption keys and later named its alleged administrator. The group attempted relaunches afterwards but with far lower impact.

Sources: attack.mitre.org · attack.mitre.org · nationalcrimeagency.gov.uk · cisa.gov · MITRE ATT&CK reference S1202