Loading malware…
LockBit 3 Black is ransomware generated using a builder associated with the LockBit ransomware-as-a-service ecosystem that was leaked in 2022. It encrypts victim data and has been used by the pro-Ukrainian Bearlyfy (Labubu) group in attacks against Russian organizations. Bearlyfy used LockBit 3 Black during its earlier operations before transitioning toward self-developed ransomware.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Изначально для шифрования данных Bearlyfy использовали LockBit 3 Black и свою доработанную версию Babuk.
1 distinct technique documented for this family, organized by ATT&CK tactic.
Bearlyfy has carried out more than 70 cyberattacks against Russian companies over the past year and is now escalating its campaign with newly developed ransomware tools... Since early March, Bearlyfy has used a custom-built Windows ransomware strain known as GenieLocker... Earlier Bearlyfy attacks relied heavily on existing ransomware tools... LockBit 3 Black... On Linux systems, the group deployed a modified version of the Babuk ransomware. | The group’s primary goals are both financial and political. They appear to be causing “maximum damage” to Russian companies while also generating revenue through ransomware payments.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Publicly available ransomware mentioned as tooling that pro-Ukrainian hacktivist groups have reportedly moved away from in favor of internally developed malware.
Widely available ransomware mentioned as software that some pro-Ukrainian groups have stopped using in favor of custom malware.
A ransomware variant built using the leaked LockBit ransomware-as-a-service builder and used by Bearlyfy in earlier attacks.
Ransomware used by Bearlyfy in earlier attacks for data encryption before the group shifted to other ransomware variants and later to its own custom ransomware.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.