What tactics and techniques does LockBit use?

How LockBit Typically Gets In and Spreads

LockBit activity usually starts with some form of initial access, then quickly shifts into hands-on operator action. Stolen credentials, exploited public-facing systems, and access bought through partners or brokers are all common entry paths. Once inside, attackers aim to turn a single foothold into broad control by using legitimate remote tools and standard admin workflows.

That combination matters because it blends in with normal operations. Remote management utilities, file sharing, remote desktop access and common scripting can all be abused without needing exotic malware at the outset. The more the environment relies on flat internal trust, the easier it is for LockBit operators to move laterally after the first compromise.

For defenders, the practical question is not just how the intruder arrived, but whether the environment lets a low-friction foothold become domain-wide reach. A single compromised account, especially one with remote administration rights, can be enough to start the next stage of the attack.

Privilege Escalation, Evasion and Ransomware Execution

LockBit techniques commonly progress toward privilege escalation, defence evasion and eventual ransomware deployment. Attackers want higher privileges so they can disable security tools, tamper with backups, and run actions at scale. They also try to reduce visibility by using living-off-the-land utilities, clearing traces, and operating through trusted remote administration channels.

Encryption is usually the final disruptive step, but it is typically preceded by staging, discovery and preparation. Before launching the payload, operators often check what can be accessed, what can be stopped, and what can be exfiltrated. That preparatory phase is where defenders sometimes get their best chance to detect the campaign before the impact event.

Because the workflow is deliberate, blue teams should look for chains of behaviour rather than single alerts. A suspicious login, followed by privilege change, remote tooling, backup interference and bulk file activity, is far more meaningful than any one event on its own.

What the Observable Behaviours Usually Look Like

LockBit operations often leave a recognisable pattern even when the tooling changes. Mass file renames, unusual archive creation, disabled or deleted backups, abnormal remote administration, and rapid movement of data toward external destinations are all practical warning signs. These indicators are especially important when they appear together across multiple systems in a short window.

The pattern also helps separate ransomware preparation from ordinary admin work. Normal maintenance may involve remote access or compression, but it should not usually coincide with large-scale file modification, backup suppression and exfiltration attempts. Correlating endpoint, identity and network telemetry is the most reliable way to turn those fragments into a coherent incident picture. MITRE ATT&CK Enterprise Matrix is useful here because it maps privilege escalation, lateral movement, remote service abuse and exfiltration into a single adversary model. Ransomware Groups Guide adds context on LockBit’s operating model, affiliate structure and common TTPs. Top 10 Phishing Techniques is also relevant where initial access is achieved through credential theft or other social engineering paths.

Risk and Threat Considerations

LockBit is dangerous not only because it encrypts systems, but because its access path often looks like routine administration until the blast radius is already large. Stolen credentials, partner access and remote tools all exploit legitimate trust relationships, which makes early detection harder and containment more urgent once the operator starts moving laterally.

Failure mechanism: An attacker converts a single valid foothold into elevated privileges, then abuses trusted remote access, backup tampering and bulk file operations to prepare encryption and extortion.

Impact: Organisations can lose availability, data confidentiality and recovery options at the same time, especially if backup systems, admin tooling and lateral movement paths are not tightly segmented.

Practitioner Guidance

What to prioritise: Treat credentialed access paths, remote admin channels and backup controls as the primary containment surface. If you only watch for encryption events, you are already late.

What to verify: Confirm that privileged accounts are MFA-protected, that remote admin use is expected and logged, and that backup systems cannot be modified from ordinary user or workstation contexts. Also verify that file-renaming bursts and archive creation are visible at the endpoint and file-server layers.

Decision rule: If you see authenticated access from an unusual source followed by privilege changes, remote tool use or backup disruption, escalate as a likely ransomware preparation chain even before encryption starts.

Practitioner takeaway: The highest-value control is not a single ransomware detector, but the ability to spot and interrupt the full sequence from valid access to lateral movement, staging and recovery suppression.

Related resources from NHI Mgmt Group

• What tactics and techniques do Lazarus crypto heists use?
• What tactics and techniques does APT29 use?
• What tactics and techniques does Conti use?
• What tactics and techniques does BlackCat (ALPHV) use?