LIVE Threat Watch 36 actively exploited vulnerabilities added in the last 30 days. Latest: CVE-2026-118527 in Ivanti Connect Secure See all live vulnerabilities
+44 1865 950 828 Secure Your Business
ActiveGovernment Reporting

LockBit

A ransomware-as-a-service operation that UK-led police action hit hard in 2024. Its administrator is named and sanctioned, but the brand returned with LockBit 5.0 in 2025 and was still listing victims in 2026.

Threat actor profile. Last reviewed 3 November 2026.

Overview

Why It Matters

The UK link is direct. The NCA says more than 7,000 attacks were built using LockBit's services between June 2022 and February 2024, with the UK among the five countries hit most. It proactively contacted nearly 240 UK victims.2 NCSC-UK also co-authored the 2023 international guide to the group.1

Operation Cronos in February 2024 took control of LockBit's administration environment and leak site, and yielded more than 1,000 decryption keys. The NCA also found that some victims who paid still had their data held, so payment did not guarantee deletion.7 In May 2024 the UK, US and Australia named and sanctioned Dmitry Khoroshev as its administrator and developer.2 That matters to victims as well as to the group, because a payment could raise sanctions questions.8

The brand did not disappear. LockBit announced version 5.0 in September 2025, with Windows, Linux and ESXi attacks seen by Check Point,9 and launched a new leak site in December 2025.4 Check Point describes a spike in the first quarter of 2026 tied to the relaunch and a decline in the second quarter, with most victims outside the US.6

Our View

Treat the 2024 action as a real reduction in trust and scale, not an end. Because affiliates differ, the methods below show what to expect in general and not one fixed playbook.

Attack Chain

How It Attacks

Based on the 2023 international advisory.1 LockBit is run through affiliates, so tooling and order vary between intrusions. The 5.0 version may differ in detail.

  1. 1

    Get In

    Affiliates use drive-by compromise, exploitation of public-facing applications, external remote services such as RDP, phishing and valid accounts. They may also brute force VPN or RDP.

  2. 2

    Expand Access

    Repurposes legitimate tools for discovery, credential dumping, remote access and tunnelling. Affiliates exploited Citrix Bleed to hijack valid sessions, bypassing passwords and MFA.10

  3. 3

    Steal the Data

    Moves data out using the custom StealBit tool or public tools and services such as Rclone and MEGA.

  4. 4

    Encrypt and Extort

    Deploys the encryptor, including versions for Linux and ESXi, then pressures victims through a leak site.

MITRE ATT&CK

Key Techniques

The first group comes from the 2023 advisory1 and the rest from the ATT&CK v20 entry for LockBit 3.0, which is a software entry and not a group entry.11

IDTechniqueTacticWhat It Looks Like
T1189Drive-by CompromiseInitial AccessReported affiliate entry method.
T1190Exploit Public-Facing ApplicationInitial AccessIncludes known flaws in internet-facing products.
T1133External Remote ServicesInitial AccessRDP in particular.
T1078Valid AccountsInitial AccessStolen or bought credentials.
T1566PhishingInitial AccessReported affiliate entry method.
T1548.002Bypass User Account ControlPrivilege EscalationElevates through a COM interface.
T1484.001Group Policy ModificationPrivilege EscalationCan spread through Group Policy Objects.
T1685Disable or Modify ToolsDefense ImpairmentCan disable security tools including Windows Defender.
T1490Inhibit System RecoveryImpactCan delete volume shadow copies.
T1486Data Encrypted for ImpactImpactEncrypts data on the victim's systems.
Tooling

Tools Observed

Custom

StealBit

Discovery and Credentials

AdFindAdvanced IP ScannerMimikatz

Remote Access and Movement

AnyDeskImpacketPsExec

Data Theft

FileZillaMEGARcloneWinSCP

From the 2023 advisory, which warns that these legitimate tools should not be treated as evidence of LockBit use without more.1 We have not seen a comparable government tool list for LockBit 5.0.

Vulnerabilities

Named in US and allied advisories from 2023. Halcyon reports that no CVEs had been attributed to the 5.0 payload as of June 2026.5

CVE-2023-4966Citrix NetScaler ADC and Gateway (Citrix Bleed), used by LockBit 3.0 affiliates to hijack sessions.10 In the CISA KEV catalogue since 18 October 2023, with known ransomware use.12
CVE-2023-27350PaperCut MF/NG improper access control.1 In the CISA KEV catalogue since 21 April 2023, with known ransomware use.12
CVE-2023-0669Fortra GoAnywhere MFT remote code execution.1 In the CISA KEV catalogue since 10 February 2023, with known ransomware use.12
CVE-2021-44228Apache Log4j2 remote code execution.1 In the CISA KEV catalogue since 10 December 2021, with known ransomware use.12
CVE-2021-22986F5 BIG-IP and BIG-IQ iControl REST remote code execution.1 In the CISA KEV catalogue since 3 November 2021, with known ransomware use.12
CVE-2020-1472Windows Netlogon privilege escalation.1 In the CISA KEV catalogue since 3 November 2021, with known ransomware use.12
CVE-2019-0708Microsoft Remote Desktop Services remote code execution.1 In the CISA KEV catalogue since 3 November 2021, with known ransomware use.12
CVE-2018-13379Fortinet FortiOS SSL VPN path traversal.1 In the CISA KEV catalogue since 3 November 2021, with known ransomware use.12

These are old flaws with patches available. A list from 2023 will not cover what current affiliates are using, so patch by exposure and known exploitation, not by this list alone.

History

Key Events

  1. ABCD, the predecessor, first observed.1

  2. LockBit-named ransomware appears on Russian-language forums.1

  3. International advisory published with NCSC-UK as a co-author.1

  4. Advisory on affiliates exploiting Citrix Bleed.10

  5. Operation Cronos: the NCA takes over the platform, and two people are arrested in Poland and Ukraine.7

  6. Khoroshev named and sanctioned. The NCA says active affiliates fell from 194 to 69.2

  7. Further phase announced: arrests linked to France, the UK and Spain, and an NCA finding that an Evil Corp member worked as a LockBit affiliate.13

  8. Alleged developer Rostislav Panev extradited to the US from Israel. These are accusations, and he is presumed innocent.3

  9. LockBit 5.0 announced on underground forums, with new affiliate recruitment.9

  10. New leak site launched.4

  11. Claims continue. Halcyon reports a decline through spring and a June rebound, and says a coalition announced with DragonForce and Qilin has shown no joint leak site or confirmed joint attacks.5 BlackFog logged a September claim.14

What To Do

Defences That Matter

Reduce the Way In

  • Patch internet-facing systems first, prioritising known exploited vulnerabilities.1
  • Disable unused services such as RDP and limit exposed admin interfaces.1
  • Use phishing-resistant MFA, especially for remote access and privileged accounts.1
Vulnerability management

Limit the Spread

  • Segment networks and apply least privilege.1
  • Allowlist applications and restrict command-line and scripting use.1
  • Enable enhanced PowerShell logging and monitor lateral movement with EDR.1
24x7x365 MDR

Protect Recovery

  • Keep encrypted, immutable, offline backups and test restores.1
  • Include ESXi and Linux hosts in recovery tests, as current versions target them.9
Business continuity and disaster recovery

Plan the Payment Question

  • Take legal advice early on sanctions if extortion is involved.
  • Do not assume payment removes data. The NCA found otherwise.7
Incident response

Would You Spot a LockBit Affiliate Before Encryption?

We can test your exposure and detection against the methods in this profile, and then help you close the gaps.

Talk to Our Team
Evidence

Sources

  1. CISA, FBI, NCSC-UK and partners: Understanding Ransomware Threat Actors: LockBit, AA23-165A, 14 June 2023
  2. National Crime Agency: LockBit leader unmasked and sanctioned, 7 May 2024
  3. US Attorney's Office, District of New Jersey: Dual Russian and Israeli national extradited for his role in LockBit, 13 March 2025
  4. Arete: LockBit 5.0: The RaaS That Refuses to Go Away, 20 January 2026
  5. Halcyon: LockBit (5.0) threat group profile, last updated 27 July 2026
  6. Check Point Research: The State of Ransomware Q2 2026, covering April to June 2026
  7. National Crime Agency: International investigation disrupts the world's most harmful cyber crime group, 20 February 2024
  8. BleepingComputer: LockBit ransomware admin identified, sanctioned in US, UK, Australia, 7 May 2024
  9. Check Point Research: LockBit 5.0: Ransomware Gang Returns in Force, 23 October 2025
  10. CISA, FBI, MS-ISAC and ASD's ACSC: LockBit 3.0 Affiliates Exploit CVE-2023-4966, AA23-325A, 21 November 2023
  11. MITRE ATT&CK: LockBit 3.0 (S1202), ATT&CK v20
  12. CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
  13. Sophos: Operation Cronos continues, on the announcements of 30 September and 1 October 2024
  14. BlackFog: The State of Ransomware 2026, running log of claimed attacks, read 3 November 2026

MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.