LockBit 3.0: what its OPSEC shift means for defenders

TL;DR: LockBit has evolved from ABCD ransomware into LockBit 3.0, with nearly 40% of ransomware attacks in 2022 attributed to the group and a new emphasis on operational security, including a $1 million bug bounty, according to Todyl analysis. Ransomware governance now has to treat attacker professionalism, not just encryption payloads, as part of the threat model.

Editorial analysis by NHI Mgmt Group, based on content published by Todyl: “Ransomware Spotlight: LockBit Ransomware-as-a-Service”.

By the numbers:

• LockBit was credited with nearly 40% of ransomware attacks so far in 2022.

Key questions

Q: Why does ransomware as a service increase the scale of ransomware attacks?

A: Ransomware as a service lowers the technical barrier to entry.

Q: What does stronger OPSEC mean for ransomware defenders?

A: It means the attacker is deliberately reducing the signals defenders usually rely on, such as exposed infrastructure, careless communications, or reusable operational mistakes.

Q: What are the signs that a ransomware operation is maturing beyond simple file encryption?

A: A more mature ransomware operation usually shows multiple indicators: data theft before encryption, leak-site publishing, affiliate recruitment, recurring wallet patterns, and payments for supporting services such as hosting.

Practitioner guidance

• Map ransomware response to the affiliate model Separate controls for initial access, deployment, encryption, negotiation, and recovery so that you can respond even when the operator and affiliate roles differ.
• Hunt for operational security indicators Look for infrastructure hygiene, compartmentalised communication, and repeatable affiliate patterns that suggest the group is reducing its exposure rather than improvising.
• Rehearse recovery against service-style ransomware Validate restore points, recovery order, and business decision authority before an incident so the team can act when ransomware pressure is coordinated and time-sensitive.

Bottom line: LockBit’s evolution shows ransomware groups can operate like service businesses, which makes disruption harder than stopping a single malware sample.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →