LockBit 3.0Malware
- LockBit Black
LockBit 3.0 is an evolution of the LockBit Ransomware-as-a-Service (RaaS) offering with similarities to BlackMatter and BlackCat ransomware. LockBit 3.0 has been in use since at least June 2022 and features enhanced defense evasion and exfiltration tactics, robust encryption methods for Windows and VMware ESXi systems, and a more refined RaaS structure over its predecessors such as LockBit 2.0.From MITRE ATT&CK
Last reported 3 months ago, by Huntress7 reports
ATT&CK techniques
6 of 55 · each with the sentence it comes from- T1059Command and Scripting Interpreter
“T1059.001 Command and Scripting Interpreter: PowerShell”
- T1490Inhibit System Recovery
“As almost ubiquitous features (T1490) of most ransomware, Hunters International’s ransomware deletes Windows Shadow Copies, Windows Backup Catalog, as well as disable automatic Windows recovery features by running the following commands:”
- T1685Disable or Modify Tools
“Impair Defenses, Disable or Modify Tools (T1562.001)”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Software Packing (T1027.002 )”
- T1027.002Software Packing
“Obfuscated Files or Information: Software Packing (T1027.002 )”
- T1059.003Windows Command Shell
“T1059.003”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
7 reports, newest first · the exact sentence from each-
It’s Not Safe To Pay SafePa“Reverse engineering the ransomware binary turned up extensive overlap with leaked LockBit Black source code, right down to shared command-line flags and encryption logic, though SafePay has added its own features on top, including a Cyrillic language kill switch that stops the ma…”
-
EDR killers explicados: Más allá de los drivers“…rentes a lo largo del tiempo, desde versiones personalizadas hasta variantes basadas en Babyk o generadas con el builder filtrado de LockBit Black.”
-
EDR killers explained: Beyond the drivers“… employed multiple different encryptors over time, ranging from custom ones to variants based on Babyk or generated using the leaked LockBit Black builder.”
-
Apache ActiveMQ Exploit Leads to LockBit Ransomware“Based on the ransom note dropped after execution, we assess that the ransomware was created using the leaked LockBit Black builder.”
-
The beginning of the end: the story of Hunters International“This technique – System Binary Proxy Execution: Regsvr32 (T1218.010) – has also been described by other ransomware groups such as LockBit, Black Suit (aka Royal) and Qilin, as they also provide ransomware in the form of DLL.”
-
Inside the Dragon: DragonForce Ransomware Group“LockBit 3.0 is also known as LockBit Black ransomware.”
-
ConnectWise/R1Soft RCE & Supply Chain Risks“…river to gain code execution, and 3) use the REST API to trigger commands to registered agents to ultimately push the recently leaked Lockbit 3.0 ransomware to all downstream endpoints.”
Indicators in its reports
named in the reports above- 82ed942a52cdcf12…ba37619661a3in 2 reports
- 54547180a99474b0…8f3eea78b531in 2 reports
- 75f85caea52fe5a1…bd3161690addin 2 reports
- 002573d80091f7f8…2b85fa915f19in 2 reports
- 1e7567c0d525ad03…f40541994411in 2 reports
- 65c2388b0afb1d1f…d8d6cd8b5645in 2 reports
- a9f37104d2d89051…bff44d147e67in 2 reports
- 083f604377d74c43…e34ad7daceeain 2 reports
- 570161a420992280…800296b72d1cin 2 reports
- bbe0e14bc7ece8a7…0476cfcef110in 2 reports
- 31ce76931ca09d39…3bc72e6d647ein 2 reports
- b9820bf443c37557…e3a569a1b9e8in 2 reports
- 34270b07538b7357…8f234b602f93in 2 reports
- 09735640d6634b03…bc80f932126cin 2 reports
- 85bc0a4f67522d6a…5a2945ec5028in 2 reports
- 711c95fead2215e9…0d71ad5c5aa5in 2 reports
- bc65ed919988c8e4…45456601700ain 2 reports
- 148c0cde4f2ef807…0f4c519f47efin 2 reports
- 468121e7d6952799…937c4c5f92edin 2 reports
- c881f43c7fe94a6f…32fe56d8dd9cin 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.