LockBit

LockBit is a prolific cybercriminal ransomware operation that has operated as a ransomware-as-a-service (RaaS) ecosystem with a core operator team and a broad affiliate network. It is widely tracked under aliases including LockBit, LockBit 2.0, LockBit Black, LockBit 3.0, LockBit Green, LockBitSupp, and more recently LockBit 5.0. The group is financially motivated rather than a nation-state actor, although its infrastructure and support ecosystem have intersected with other criminal service providers and bulletproof hosting operators. LockBit has targeted organizations across a wide range of sectors and geographies, including manufacturing, education, government, healthcare, retail, technology, consulting, hospitality, and other commercial and public-sector entities. The operation is known for high-volume victimization and public extortion through leak-site postings, and it has remained one of the most recognizable ransomware brands even after law-enforcement disruption and sanctions activity. Operationally, LockBit and its affiliates commonly combine data theft with encryption and extortion, though the broader ransomware landscape in which it operates has increasingly included data-only extortion. Reported tradecraft associated with LockBit activity includes abuse of Remote Desktop Protocol for unauthorized access and lateral movement, use of legitimate remote access and administration tools, and use of common dual-use utilities to support reconnaissance, persistence, and exfiltration. LockBit-linked intrusions have also been associated with use of tools such as FileZilla for exfiltration support, AnyDesk for remote access, and network-scanning utilities for internal discovery. The group has been observed relying on legitimate or allowlisted Windows tools and administrative mechanisms, consistent with broader ransomware affiliate tradecraft. LockBit has also been linked to exploitation trends seen across the ransomware ecosystem, including opportunistic use of exposed services and rapid weaponization of newly disclosed vulnerabilities where affiliates or associated actors can obtain access at scale. The operation’s affiliate model has enabled variation in initial access methods and post-compromise behavior across incidents. The group has undergone multiple branding and malware-version changes. LockBit 2.0 represented a major evolution of the original operation, while LockBit Black and LockBit 3.0 are commonly used names for later variants. Reporting in 2026 also references LockBit 5.0 as a continuing or reconstituted LockBit-branded operation. Despite sanctions and takedowns, LockBit retained measurable market presence in 2026 and showed signs of renewed activity after earlier disruption, indicating resilience of the brand and affiliate ecosystem. LockBit has been repeatedly connected to criminal support infrastructure. U.S. and allied authorities have alleged that bulletproof hosting providers such as Media Land and ML.Cloud supplied infrastructure or services used by LockBit alongside other ransomware groups. Such links underscore LockBit’s dependence on the broader cybercrime-as-a-service ecosystem, including hosting, anonymization, payment facilitation, and other enabling services. Overall, LockBit remains one of the most significant and enduring ransomware brands of the past several years: a decentralized extortion enterprise characterized by aggressive affiliate-driven operations, broad sector targeting, frequent use of legitimate administrative tooling, and sustained adaptability in the face of international law-enforcement pressure.