LockBitMalware
LockBit operators tend to be very indiscriminate and opportunistic in their targeting. Actors behind this attack will use a variety of methods to gain initial access, up to and including basic methods such as brute force. After gaining initial access the actor follows a fairly typical escalation, lateral movement and ransomware execution playbook.From MISP Galaxy
Last reported 2 days ago, by Security Affairs68 reports
ATT&CK techniques
6 of 155 · each with the sentence it comes from- T1053.005Scheduled Task
“Many hosts had malicious scheduled tasks executing obfuscated PowerShell scripts, and many of those hosts had PowerShell monitoring disabled.”
- T1059Command and Scripting Interpreter
“T1059.001 Command and Scripting Interpreter: PowerShell”
- T1036Masquerading
“For instance, Halcyon reported increased instances of the LLM-developed EvilAI masquerading as fake AI-productivity apps while secretly providing ransomware actors initial access.”
- T1684Social Engineering
“Mapped to ATT&CK Enterprise v19.1 (social engineering sits under T1684 in this version; the former T1656 Impersonation is now T1684.001).”
- T1685Disable or Modify Tools
“T1562.001 Impair Defenses: Disable or Modify Tools”
- T1021.001Remote Desktop Protocol
“They also employ remote desktop protocol (RDP) to expand their presence within the compromised network.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
68 reports · the newest 20, newest first · the exact sentence from each-
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations“SafePay grew as groups such as BlackCat and LockBit declined, and its activity has continued.”
-
SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns“It is believed that SafePay may be a rebrand of several other well-known groups – LockBit, ALPHV/BlackCat and INC Ransomware.”
-
Behind the Help Desk Call: Insights from the Leaked Chats of an IT-Impersonation Extortion Crew“Department of Justice’s LockBit case to argue that deletion promises cannot be trusted and lists four settlement conditions: deletion of all digital and physical copies, confirmation of the file list, no re-extortion and confidentiality.27 Henry’s private reaction confirms the vi…”
-
September 2026 Threat Trend Report on Ransomware“In September 2026, groups such as The Gentlemen, Qilin, Metaencryptor, CL0P, Storm, AUDIT TEAM, LockBit, EMPERADOR, and RansomHouse were active, and new groups like Vladivostok, Vexy, and BlackLocks also emerged.”
-
Germany Arrests Suspected Qilin Ransomware Leader After Japan Detention“In early October, DragonForce, LockBit, and Qilin formed a ransomware alliance to boost attack effectiveness, marking a major shift in the cyber threat landscape.”
-
Panorama de ciberamenazas en América Latina: balance del primer semestre de 2026“…resencia de células selectivas: Operaciones vinculadas a BlackMatter, Conti, Phobos, Akira, DragonForce y muestras residuales de LockBit o WannaCry se manifestaron mediante incidentes puntuales.”
-
Inside DragonForce: How a Ransomware Cartel’s Payload Actually Runs“Early payloads were built on leaked LockBit 3.0 source code and later supplemented with code derived from the leaked Conti builder.”
-
Gotta Breach 'Em All! The Journey Of ShinyHunters“This might be seen as an attempt to fill the void left by LockBit's decline?”
-
Ransomware Attacks Reach Record High for 2026“Read More: A CISO's Lessons in Ransomware Response and Recovery After a Real-World LockBit Attack”
-
Most Firms Unable to Recover Quickly from Ransomware“Read more on ransomware recovery: CISO Lessons in Ransomware Response and Recovery After a Real-World LockBit Attack”
-
Security Issues in the Korean & Global Financial Sector in August 2026“Ransomware groups such as CRPx0, Dysphor1A, LockBit 5.0, And LockBit targeted the financial sector and posted victims on DLS (Dedicated Leak Sites, public extortion sites).”
-
July 2026 Ransomware Trend Report“Existing groups such as The Gentlemen, DragonForce, Nova, Gunra, Everest, krybit, LockBit (LockBit 5.0), Qilin, Chaos, ShinyHunters, Morpheus, INC Ransom, and Coinbase Cartel continued their activities, while new data-stealing and ransomware groups—including Gammax, SECTION9, Exf…”
-
Ransomware Groups Increasingly Deploy EDR Kill Techniques“…h Center shared that The Gentlemen’s developers are systematically reverse-engineering samples from other groups, such as Babuk, Qilin, LockBit 5.0 and Medusa, to select the strongest encryption routines, code-obfuscation techniques and EDR evasion methods to incorporate into the…”
-
Ransomware Attacks Targeting Universities on the Rise“… ransomware attacks against the education sector were The Gentlemen and Qilin, which accounted for 15 claimed attacks each, followed by LockBit, which claimed 9, then Interlock and Nova, which claimed 6 each.”
-
Government Agencies Falling Victim to Ransomware Daily, Warns Study“The most common attackers between January and June were The Gentlemen (10%), Qilin (9%) and LockBit (7%).”
-
25,000 IPs Scanned Cisco ASA Devices — New Vulnerability Potentially Incoming“Ransomware: The Akira and LockBit ransomware groups have historically targeted Cisco ASA systems.”
-
The old way: BabLock, new ransomware quietly cruising around Europe, Middle East, and Asia“For comparison, in addition to the list above, LockBit 3.0 (Black) checks for Tatar (444), Romanian Moldova (818) and Arabic Syria (2801).”
-
Take control of your shadow IT“That is how long it took the hacker group LockBit to penetrate the victim’s infrastructure and launch the ransomware.”
-
It’s alive!“…entative as part of an interview for Recorded Future, the work on the ransomware took about six months, and the best solutions from the LockBit, REvil, and DarkSide programs were used to create the program.”
-
BlackCat Ransomware: Tactics, Techniques & Mitigation Strategies“…n ransomware attacks in 2023, where victim data was posted on leak sites, making it the second most active group that year (behind only LockBit’s 1,079 incidents).”
Thanks — we review every report.