LockBit Ransomware Group
View MITRE Group Page ↗Key Facts
- Attributed Country: Russian Federation.
- ATT&CK Group Reference: G1020 (LockBit Ransomware Group).
- Linked to 1 primary court prosecution record(s) with $500.0 million documented loss.
- Identified 4 individually charged operative(s) and 1 OFAC designation(s).
Primary ATT&CK Techniques Employed
| Technique | Frequency |
|---|---|
| T1486 Data Encrypted for Impact | 1 incidents |
| T1567 Exfiltration Over Web Service | 1 incidents |
| T1490 Inhibit System Recovery | 1 incidents |
| T1190 Exploit Public-Facing Application | 1 incidents |
| T1078 Valid Accounts | 1 incidents |
| T1047 Windows Management Instrumentation | 1 incidents |
| T1562.001 Disable or Modify Tools | 1 incidents |
| T1558.003 Kerberoasting | 1 incidents |
Prosecution Cases Attributed to LockBit Ransomware Group
U.S. v. Khoroshev et al. (LockBit Ransomware Operation)
Comprehensive global law enforcement takedown (Operation Cronos) of LockBit ransomware infrastructure, unmasking creator Dmitry Khoroshev (LockBitSupp) and multiple active affiliates who extorted over $500 million from thousands of victims.
Indicted Operatives & Dispositions (4)
Developer and primary administrative operator of LockBit ransomware. Indicted in D.N.J. in May 2024 with a $10 million State Department reward.
High-profile LockBit affiliate arrested in Ontario, Canada, with firearms and cryptocurrency recovery.
Arrested in Arizona in June 2023 for carrying out LockBit attacks against victims in Florida, Japan, and France.
LockBit affiliate indicted in D.N.J. in February 2024 for targeting manufacturing and insurance firms.
Treasury OFAC Sanctions Actions
Developer and key leader of the LockBit ransomware group, designated in coordination with the UK and Australia.
Official Treasury Press Release ↗Documented TTP Signature for LockBit Ransomware Group
Test Controls in Stack Audit →Adversaries encrypt victim files and databases to disrupt business operations and demand financial extortion.
Adversaries exfiltrate sensitive files to legitimate cloud storage providers like Mega or Google Drive.
Adversaries delete volume shadow copies and system restore points to prevent recovery from ransomware.
Adversaries exploit vulnerabilities in internet-connected software such as web servers or VPN appliances.
Adversaries obtain and misuse legitimate credentials of existing user accounts to maintain persistence and bypass controls.
Adversaries abuse WMI to execute malicious commands and query administrative system details.