LockBit 3 Black
LockBit 3 Black is a ransomware variant associated with the LockBit ransomware-as-a-service ecosystem. The provided content states it was created using a builder for the LockBit RaaS platform that leaked online in 2022. In the cited reporting, the pro-Ukrainian threat group Bearlyfy (also known as Labubu) used LockBit 3 Black in earlier attacks to encrypt victim data, primarily in campaigns targeting Russian companies. Bearlyfy reportedly conducted more than 70 attacks since January 2025 and initially relied on leaked ransomware tooling, including LockBit 3 Black, before later shifting to other families and eventually self-developed ransomware. The content does not provide specific technical IOCs or detailed behavioral characteristics for LockBit 3 Black beyond its use for data encryption and its origin from the leaked LockBit builder.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Изначально для шифрования данных Bearlyfy использовали LockBit 3 Black и свою доработанную версию Babuk.
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Impact
1 techniqueBearlyfy has carried out more than 70 cyberattacks against Russian companies over the past year and is now escalating its campaign with newly developed ransomware tools... Since early March, Bearlyfy has used a custom-built Windows ransomware strain known as GenieLocker... Earlier Bearlyfy attacks relied heavily on existing ransomware tools... LockBit 3 Black... On Linux systems, the group deployed a modified version of the Babuk ransomware. | The group’s primary goals are both financial and political. They appear to be causing “maximum damage” to Russian companies while also generating revenue through ransomware payments.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ransomware variant built using the leaked LockBit ransomware-as-a-service builder and used by Bearlyfy in earlier attacks.
Ransomware used by Bearlyfy in earlier attacks for data encryption before the group shifted to other ransomware variants and later to its own custom ransomware.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.