LockBit

Affiliates gain entry through phishing campaigns (T1566) with malicious links or attachments, exploiting vulnerabilities like CVE-2023-4966 (Citrix Bleed), conducting brute-force attacks (T1110) on Remote Desktop Protocol (RDP) endpoints, and recruiting insider threats (T1078) to provide valid credentials. Initial Access Brokers supply pre-compromised access to high-value networks.

Reconnaissance employs Advanced Port Scanner to identify open ports, SoftPerfect Network Scanner for network mapping, and manual searches for backup directories, cloud storage locations, and valuable data repositories. Affiliates utilize Windows Management Instrumentation (WMI) queries and PowerShell scripts for automated discovery.

Deployment includes AnyDesk, TeamViewer, and ScreenConnect for persistent access, Cobalt Strike beacons for operations, and custom backdoors integrated with legitimate remote management tools to evade detection.

Evasion techniques incorporate password-protected executables requiring specific arguments, Safe Mode deployment disabling endpoint protection, process injection (T1055) into legitimate processes, and LOLBins usage to blend with normal operations. Registry modifications disable Windows Defender and security services.

Credential theft utilizes Mimikatz (T1003) for password extraction, LSASS memory dumps for credential harvesting, keyloggers for capturing authentication data, and exploitation of stored credentials in browsers and applications.

C2 infrastructure operates through TOR-based channels for anonymity, HTTPS callbacks on ports 443 and 8443, domain fronting techniques for traffic obfuscation, and API-based communication with encrypted payloads.

Movement techniques leverage PsExec and SMB (T1021) for command execution, WMI for remote execution, Wake-on-LAN to activate dormant devices, and exploitation of trust relationships between systems.

Data theft employs StealBit, a proprietary tool for targeted exfiltration, Rclone and cloud platforms like MEGA for data transfer, TOR-based channels for encrypted transmission, and multi-threaded operations optimizing transfer speeds.

Persistence mechanisms include scheduled tasks (T1053) and unauthorized service creation, registry modifications (T1547) for startup execution, DLL hijacking for process manipulation, and installation of remote access tools maintaining long-term access.

Attack consequences encompass complete file system encryption rendering data inaccessible, potential data exposure through double extortion tactics, operational disruption lasting days to weeks, and reputational damage from public data leaks. Recovery costs often exceed initial ransom demands.

Encryption deployment uses AES-256 for rapid file encryption, RSA-2048 for key management, multi-threading to maximize speed, and Safe Mode operation bypassing security controls. Partial encryption options enable faster operations on large files.

Extortion tactics feature custom ransom notes named VictimID.README.txt, TOR negotiation portals for anonymous communication, dark web data leak sites for publishing stolen information, and countdown timers pressuring victims with escalating demands.

Anti-forensics activities include event log deletion with wevtutil cl System commands, shadow copy deletion (vssadmin delete shadows /all /quiet) preventing recovery, self-deletion of ransomware executables after encryption, and prefetch and USN journal clearing.