LockBit Threat Actor Profile: Operations, Disruption and Defences

LockBit was the most deployed ransomware-as-a-service (RaaS) operation of the early 2020s, and its affiliates got in mostly through exposed remote access, unpatched edge devices and stolen or weak credentials. This profile draws only on the joint #StopRansomware and LockBit advisories from CISA, the FBI and international partners, US Department of Justice announcements on Operation Cronos and related charges, MITRE ATT&CK v20 and published vendor research. It covers who LockBit is, how its affiliates operated, how the February 2024 disruption changed the picture and what defenders should detect and harden. It is written for security operations, identity and infrastructure leads. It does not reproduce leak-site content, and it names individuals only where governments have publicly charged or sanctioned them.

Key takeaways

• A franchise, not a single crew. LockBit was run as RaaS: a core team supplied the encryptor, the affiliate panel and the leak site, while affiliates broke in and deployed it, so intrusion techniques vary widely between incidents. The Cybercrime Ecosystem Guide explains how RaaS, access brokers and hosting fit together.
• Initial access is ordinary. The joint advisory lists exploitation of public-facing applications, RDP and other external remote services, phishing, valid accounts and brute force against VPN or RDP as the main entry routes.
• Credentials drive the middle of the attack. Affiliates used Mimikatz, LSASS dumps, browser credential stealers and stolen NetScaler session cookies to reach domain-level access, then pushed the encryptor through Group Policy, PsExec or SMB.
• Disruption degraded, but did not end, the brand. Operation Cronos seized LockBit infrastructure on 19 and 20 February 2024 and recovered decryption keys, but vendor research reported a new LockBit 5.0 build for Windows, Linux and ESXi in September 2025.
• Defences that work against LockBit work against most RaaS. Fast patching of internet-facing systems, phishing-resistant MFA on remote access, tiered administration, control of remote monitoring and management (RMM) tools and immutable backups break most of the documented chain.

Who they are (names and aliases)

CISA's June 2023 joint advisory AA23-165A, published with the FBI, MS-ISAC and international partner agencies, traces LockBit from the ABCD ransomware first observed in September 2019 to the LockBit name on Russian-language forums in January 2020. MITRE ATT&CK v20 tracks the later encryptors as software entries LockBit 2.0 (S1199) and LockBit 3.0 (S1202), with LockBit Black as an alias of 3.0.

Leadership as publicly charged: in May 2024 the US Department of Justice unsealed an indictment against a Russian national alleged to be the administrator known as "LockBitSupp", and the US, UK and Australia sanctioned that individual. By March 2025 the District of New Jersey had charged seven alleged LockBit members, including an alleged developer extradited from Israel. These are allegations; defendants are presumed innocent unless proven guilty. One practical caution for attribution: because the LockBit 3.0 builder leaked in 2022, a LockBit-style encryptor in your estate does not prove LockBit affiliates were involved.

Targeting and motivation

LockBit is financially motivated and opportunistic. Its affiliates chose victims largely by exposure and ability to pay rather than by sector, which is why the advisories describe impact across critical infrastructure, government, education, healthcare, manufacturing and financial services.

The economics explain the behaviour. DOJ alleges the administrator took 20% of each ransom and affiliates 80%, which rewards affiliates for volume and speed. The model is double extortion: encrypt systems and threaten to publish stolen data. DOJ also states that seized infrastructure showed copies of data from victims who had paid and been promised deletion, a point worth noting in any discussion of whether payment buys confidentiality. See the Ransomware Payments and Sanctions Guide, since paying a sanctioned individual creates separate legal exposure.

Tactics and techniques (MITRE ATT&CK)

The table maps behaviour reported in CISA AA23-165A and AA23-325A, and in the ATT&CK v20 entries for S1199 and S1202, to current technique IDs. The 2023 advisories used ATT&CK v13.1; where v20 retired an ID (the former Impair Defenses technique), the current equivalent is shown.

CISA AA23-165A lists the CVEs affiliates exploited, all present in the CISA Known Exploited Vulnerabilities (KEV) catalogue: CVE-2018-13379 (Fortinet FortiOS SSL VPN), CVE-2019-0708 (Microsoft Remote Desktop Services), CVE-2020-1472 (Netlogon), CVE-2021-22986 (F5 BIG-IP and BIG-IQ), CVE-2021-44228 (Apache Log4j2), CVE-2023-0669 (Fortra GoAnywhere MFT) and CVE-2023-27350 (PaperCut MF/NG). AA23-325A added CVE-2023-4966, CitrixBleed. Vendor research on LockBit 5.0 reports Event Tracing for Windows patching, termination of security services from a list of 63 hashed names, clearing of event logs after encryption and an exit on Russian language or location settings (consistent with T1614.001 System Language Discovery in the ATT&CK entries). See the Living off the Land Guide for the dual-use tool problem.

How they abuse identities and credentials

Most documented LockBit intrusions are identity attacks with ransomware at the end. The patterns below come from the two CISA advisories.

• Remote access accounts: affiliates used valid VPN and RDP credentials, often bought from initial access brokers or obtained by brute force. CISA asks for phishing-resistant MFA on VPN, webmail and privileged accounts and closure of unused RDP (TCP 3389). See the Remote Access Identity Guide.
• Session tokens that bypass MFA: with CitrixBleed (CVE-2023-4966) affiliates read valid NetScaler AAA session cookies from appliance memory and used them without a password or MFA prompt. Patching alone did not revoke stolen sessions, so CISA advised killing active sessions and rotating credentials used through vulnerable appliances. The CitrixBleed 2023 breach page covers the Boeing Distribution case that CISA attributes to LockBit 3.0 affiliates.
• Credential dumping: Mimikatz, ProcDump and custom tools dumped LSASS; Impacket secretsdump harvested domain hashes; one script decrypted credentials stored by Veeam backup software, which turns the backup platform into a key store for the attacker. See the Credential Dumping Guide.
• Service and local accounts: ATT&CK records LockBit 3.0 using local accounts (T1078.003) and LockBit 2.0 creating accounts (T1136). CISA recommends denying interactive and remote logon to service accounts, LAPS for local administrator passwords and restricting NTLM. See the Service Account Security Guide.
• Domain admin as the deployment channel: once affiliates hold domain administrator rights they deploy the encryptor through Group Policy (T1484.001) and PsExec. Tiering administrative accounts so that a workstation compromise cannot reach domain admin credentials removes that channel. See the Tiered Administration and Enterprise Access Model Guide.
• RMM tools as persistence: legitimate remote management software, sometimes renamed or portable, gave affiliates a signed, trusted channel. See the RMM Tool Security Guide.

Notable incidents

This section is limited to events described in official or vendor sources; it does not draw on leak-site claims.

• CitrixBleed campaign, late 2023: CISA and the FBI, with partners, published AA23-325A in November 2023 after LockBit 3.0 affiliates exploited CVE-2023-4966, including against Boeing Distribution Inc. It is the clearest official case of a ransomware affiliate bypassing MFA with stolen session state.
• Operation Cronos, February 2024: led by the UK National Crime Agency with the FBI and partners from at least ten countries, coordinated through Europol and Eurojust. Law enforcement took over LockBit's public sites, seized administrator servers and US-hosted StealBit servers, obtained decryption keys and pointed US victims to the FBI's lockbitvictims.ic3.gov portal. Trend Micro observed the sites switch to a law enforcement splash page on 19 February 2024.
• Charges and sanctions, 2023 to 2025: DOJ announced charges against affiliates in 2023 and February 2024 (OFAC designated two of them), the indictment and US, UK and Australian sanctions against the alleged administrator in May 2024, and the extradition of an alleged developer in March 2025.
• After Cronos: Trend Micro reported in April 2024 that over two thirds of the 95 victims posted after the takedown were reuploads of earlier attacks, that a leaked panel showed 193 affiliate accounts, and that affiliate trust had been damaged. In September 2025 it reported LockBit 5.0 builds for Windows, Linux and ESXi, so defenders should treat the brand as degraded rather than gone.

Detection and defence

What to log and hunt

Hardening, in priority order

1. Close the front door: patch KEV-listed edge vulnerabilities within 24 to 48 hours as CISA advises, take NetScaler, Fortinet, F5 and file transfer appliances off the internet where possible, and remove direct RDP exposure. See the Patch Management Guide.
2. Harden remote access identity: phishing-resistant MFA on VPN, webmail and admin access; terminate sessions after edge-device patches; alert on impossible travel. See the Phishing-Resistant MFA Guide.
3. Protect credentials on endpoints: Credential Guard, LSA protection, LAPS, NTLM restrictions and tamper-protected EDR.
4. Constrain admin paths: tiered admin accounts, no domain admin logons to workstations, deny logon rights for service accounts and require approval for PsExec.
5. Allowlist remote tools: one approved RMM product; block others, including portable versions, with AppLocker or WDAC.
6. Make recovery independent: offline, immutable backups whose credentials are not in the production domain, tested regularly. See the Backup Identity Isolation Guide and, for hypervisors, the ESXi Ransomware Playbook.

Rollout and testing: start allowlisting and ASR rules in audit mode for two to four weeks, pilot on one business unit, and keep a documented rollback (policy revert, exception list) before enforcement. Test detection by replaying the advisory behaviours with an authorised emulation plan.

Small versus large organisations: a small organisation gets most value from a managed EDR service, MFA on all remote access, a single RMM tool and offline backups. A large estate should add identity threat detection on Active Directory, tiered administration and continuous external attack surface scanning.

Metrics

• Median days to patch KEV-listed vulnerabilities on internet-facing systems (target: 2 days or fewer).
• Percentage of remote access and admin logons protected by phishing-resistant MFA.
• Number of unapproved remote access tools detected per month (trend to zero).
• Percentage of endpoints with Credential Guard or LSA protection and tamper protection enabled.
• Time from LSASS-access or log-clearing alert to containment.
• Last successful full restore test from immutable backup.

Framework mapping

Practitioner checklist

• Inventory every internet-facing appliance and confirm none carry the CVEs listed in AA23-165A or CVE-2023-4966.
• Kill and reissue sessions on edge devices after every critical patch, not just the patch itself.
• Enforce phishing-resistant MFA on VPN, remote desktop gateways, webmail and all privileged accounts.
• Enable Credential Guard or LSA protection and LAPS, and alert on LSASS access.
• Deny interactive and RDP logon for service accounts; review accounts created or re-enabled in the last 90 days.
• Allow one approved RMM tool and block the rest, including portable binaries.
• Turn on PowerShell script block logging and keep at least 180 days of logs, as CISA recommends.
• Alert on GPO changes, Event ID 1102 and shadow copy deletion as high severity.
• Keep backup credentials outside the production domain and test an offline restore quarterly.
• Pre-agree with legal how you would check sanctions exposure before any ransom discussion.

Standards and references

• CISA: Understanding Ransomware Threat Actors: LockBit (AA23-165A)
• CISA and FBI: #StopRansomware: LockBit 3.0 Ransomware Affiliates Exploit CVE-2023-4966 Citrix Bleed Vulnerability (AA23-325A)
• US Department of Justice: U.S. and U.K. Disrupt LockBit Ransomware Variant
• US Department of Justice: U.S. Charges Russian National for Developing and Operating LockBit Ransomware
• MITRE ATT&CK: LockBit 3.0
• CISA: Known Exploited Vulnerabilities Catalog
• Trend Micro: Unveiling the Fallout: Operation Cronos' Impact on LockBit
• Trend Micro: New LockBit 5.0 Targets Windows, Linux, ESXi

Related NHI Mgmt Group resources: Ransomware Groups Guide · Threat Actor Groups Guide · RansomHub Threat Actor Profile · Ransomware Response and Recovery Guide · Top 10 Ransomware Initial Access Vectors